Getting Data In

Splunk TA For MSCS - Event Hubs input issues

rbaudish
Loves-to-Learn Everything

We are using the Event Hubs modular input from the SPlunk TA for Microsoft Cloud Services.

In our system, we have configured many Event Hubs inputs. However, one of those particular inputs has done some very strange things.  Most of the events received from this particular input are processed correctly however some of the events arrive in "batches", inside a "records" array. These batches can contain up to 300 child objects i.e. 300 separate events. 

In the inputs.conf, we have one input configured for this Event Hub. The interval is set to 300 secs. max_wait_time and max_batch_time are left as default. 

Has anyone else seen this before?

 

@jconger 

 event hubs batching.PNG

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...