Splunk Enterprise

Splunk_TA_microsoft-cloudservices V4.0.1 unable to read message from storage account

karthikes
New Member

Team,

We are using splunk Splunk_TA_microsoft-cloudservices V4.0.1 for reading logs from blob storage , the app works fine and reads the data from blob , when we store the file under the container without sub directories.

But when we store the files under multiple sub directories the app fails to load the files from the exact location, this is because the blob path was not encoded hence, it was not able to search and load the respective files. Could you please fix this error in "mscs_storage_blob_dispatcher.py" and do quick release.

example :

resourceId=/SUBSCRIPTIONS/7736B8F1-6136-4ECB-89B5-3DDF8C225441/RESOURCEGROUPS/ABAKASG-WAF-AAC/PROVIDERS/MICROSOFT.NETWORK/APPLICATIONGATEWAYS/ABAKASG-GW-AAC/y=2021/m=05/d=25/h=01/m=00/PT1H.json'

fix :resourceId%3D/SUBSCRIPTIONS/7736B8F1-6136-4ECB-89B5-3DDF8C225441/RESOURCEGROUPS/ABAKASG-WAF-AAC/PROVIDERS/MICROSOFT.NETWORK/APPLICATIONGATEWAYS/ABAKASG-GW-AAC/y%3D2021/m%3D05/d%3D26/h%3D12/m%3D00/PT1H.json

thanks

karthik

Labels (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...