We are using the Event Hubs modular input from the SPlunk TA for Microsoft Cloud Services.
In our system, we have configured many Event Hubs inputs. However, one of those particular inputs has done some very strange things. Most of the events received from this particular input are processed correctly however some of the events arrive in "batches", inside a "records" array. These batches can contain up to 300 child objects i.e. 300 separate events.
In the inputs.conf, we have one input configured for this Event Hub. The interval is set to 300 secs. max_wait_time and max_batch_time are left as default.
Has anyone else seen this before?
