Getting Data In

Splunk TA For MSCS - Event Hubs input issues

Loves-to-Learn Everything

We are using the Event Hubs modular input from the SPlunk TA for Microsoft Cloud Services.

In our system, we have configured many Event Hubs inputs. However, one of those particular inputs has done some very strange things.  Most of the events received from this particular input are processed correctly however some of the events arrive in "batches", inside a "records" array. These batches can contain up to 300 child objects i.e. 300 separate events. 

In the inputs.conf, we have one input configured for this Event Hub. The interval is set to 300 secs. max_wait_time and max_batch_time are left as default. 

Has anyone else seen this before?



 event hubs batching.PNG

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...