Pulling from Event Hub - how to reset sequence number?

[stevebrown]

We have been given new Connection Strings to enter into our TA-MS-AAD inputs, running on Splunk Cloud's IDM host, pulling from a client's Event Hub.  The feeds were down for several days before we were given the Strings.

The IDM is now connecting to the Event Hub again but no data is flowing; the IDM's logs say

"The supplied sequence number '5529741' is invalid. The last sequence number in the system is '4121'"

Is there anything we can do about this?

[dural_yyz · Accepted solution]

There is a collection(KVStore) which holds the checkpoint value.  You can likely edit to change or remove the current value.  I recommend keeping a backup cause editing this on your own comes with a risk, but in a test environment I would have no problem trying this first.

[TA_MS_AAD_checkpointer]
field.state = string

[stevebrown]

Great thanks @dural_yyz I'll try that.