Getting Data In

ta_ms_aad_azure_event_hub events are not pulled from Azure Event Hub

Path Finder

I have defined eventhub_splunk_dev01event hub on HF  , no events are pulled 

please assist 

 

[azure_event_hub://eventhub_splunk_dev01]
connection_string = ********
consumer_group = $Default
event_hub_name = insights-activity-logs
event_hub_timeout = 5
index = test
interval = 60
max_batch_set_iterations = 100
max_batch_size = 100
number_of_threads = 4
source_type = azure:eventhub
disabled = 1

[splunk@ilissplfwd06 local]$

 

[splunk@ilissplfwd06 splunk]$ /bin/telnet 10.67.37.117 5671
Trying 10.67.37.117...
Connected to 10.67.37.117.
Escape character is '^]'.
^CConnection closed by foreign host.
[splunk@ilissplfwd06 splunk]$ /bin/telnet 10.67.37.117 5672
Trying 10.67.37.117...
Connected to 10.67.37.117.

 

No errors in the log , only the below messages  

 

2020-10-29 16:08:41,971 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=__init__.py:deinitialize:170 | Deinitializing platform.
2020-10-29 16:08:41,971 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Deallocating 'SymbolValue'
2020-10-29 16:08:41,971 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Destroying 'SymbolValue'
2020-10-29 16:08:41,972 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Deallocating 'LongValue'
2020-10-29 16:08:41,972 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Destroying 'LongValue'
2020-10-29 16:08:41,972 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Deallocating cSource
2020-10-29 16:08:41,972 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Destroying cSource
2020-10-29 16:08:41,972 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Deallocating 'StringValue'
2020-10-29 16:08:41,972 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Destroying 'StringValue'
2020-10-29 16:08:42,008 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating cSession
2020-10-29 16:08:42,008 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating CBSTokenAuth
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating Connection
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating SASLMechanism
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating cSession
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating CBSTokenAuth
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating Connection
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating SASLMechanism
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating cSession
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating CBSTokenAuth
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating Connection
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating SASLMechanism
2020-10-29 16:08:42,010 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating cSession
2020-10-29 16:08:42,010 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating Connection
2020-10-29 16:08:42,010 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating CBSTokenAuth
2020-10-29 16:08:42,010 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,010 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,010 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating SASLMechanism
~

 

 


Escape character is '^]'.
^C^X
Connection closed by foreign host.
[splunk@ilissplfwd06 splunk]$

 

the ports are opened to Private EndPoint  

 

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!