Splunk Cloud Platform

Pulling from Event Hub - how to reset sequence number?

stevebrown
Engager

We have been given new Connection Strings to enter into our TA-MS-AAD inputs, running on Splunk Cloud's IDM host, pulling from a client's Event Hub.  The feeds were down for several days before we were given the Strings.

The IDM is now connecting to the Event Hub again but no data is flowing; the IDM's logs say

"The supplied sequence number '5529741' is invalid. The last sequence number in the system is '4121'"

Is there anything we can do about this?

Labels (1)
Tags (1)
0 Karma
1 Solution

dural_yyz
Motivator

There is a collection(KVStore) which holds the checkpoint value.  You can likely edit to change or remove the current value.  I recommend keeping a backup cause editing this on your own comes with a risk, but in a test environment I would have no problem trying this first.

[TA_MS_AAD_checkpointer]
field.state = string

View solution in original post

dural_yyz
Motivator

There is a collection(KVStore) which holds the checkpoint value.  You can likely edit to change or remove the current value.  I recommend keeping a backup cause editing this on your own comes with a risk, but in a test environment I would have no problem trying this first.

[TA_MS_AAD_checkpointer]
field.state = string

stevebrown
Engager
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...