Splunk Cloud Platform

Pulling from Event Hub - how to reset sequence number?

stevebrown
Engager

We have been given new Connection Strings to enter into our TA-MS-AAD inputs, running on Splunk Cloud's IDM host, pulling from a client's Event Hub.  The feeds were down for several days before we were given the Strings.

The IDM is now connecting to the Event Hub again but no data is flowing; the IDM's logs say

"The supplied sequence number '5529741' is invalid. The last sequence number in the system is '4121'"

Is there anything we can do about this?

Labels (1)
Tags (1)
0 Karma
1 Solution

dural_yyz
Motivator

There is a collection(KVStore) which holds the checkpoint value.  You can likely edit to change or remove the current value.  I recommend keeping a backup cause editing this on your own comes with a risk, but in a test environment I would have no problem trying this first.

[TA_MS_AAD_checkpointer]
field.state = string

View solution in original post

dural_yyz
Motivator

There is a collection(KVStore) which holds the checkpoint value.  You can likely edit to change or remove the current value.  I recommend keeping a backup cause editing this on your own comes with a risk, but in a test environment I would have no problem trying this first.

[TA_MS_AAD_checkpointer]
field.state = string

stevebrown
Engager
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...