Splunk Enterprise

Splunk_TA_microsoft-cloudservices V4.0.1 unable to read message from storage account

karthikes
New Member

Team,

We are using splunk Splunk_TA_microsoft-cloudservices V4.0.1 for reading logs from blob storage , the app works fine and reads the data from blob , when we store the file under the container without sub directories.

But when we store the files under multiple sub directories the app fails to load the files from the exact location, this is because the blob path was not encoded hence, it was not able to search and load the respective files. Could you please fix this error in "mscs_storage_blob_dispatcher.py" and do quick release.

example :

resourceId=/SUBSCRIPTIONS/7736B8F1-6136-4ECB-89B5-3DDF8C225441/RESOURCEGROUPS/ABAKASG-WAF-AAC/PROVIDERS/MICROSOFT.NETWORK/APPLICATIONGATEWAYS/ABAKASG-GW-AAC/y=2021/m=05/d=25/h=01/m=00/PT1H.json'

fix :resourceId%3D/SUBSCRIPTIONS/7736B8F1-6136-4ECB-89B5-3DDF8C225441/RESOURCEGROUPS/ABAKASG-WAF-AAC/PROVIDERS/MICROSOFT.NETWORK/APPLICATIONGATEWAYS/ABAKASG-GW-AAC/y%3D2021/m%3D05/d%3D26/h%3D12/m%3D00/PT1H.json

thanks

karthik

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...