I am using enterprise and it works without quotes with -7d@h ... View more

One common mistake is described in Structured Data Header Extraction and configuration. * When 'INDEXED_EXTRACTIONS = JSON' for a particular source type, do not also set 'KV_MODE = json' for that source type. This causes the Splunk software to extract the JSON fields twice: once at index time, and again at search time. * Default: not set ... View more

if you're familiar with Azure Logic Apps, you could consider using those to get events from the Event Hub and push them to a Splunk HEC input. The logic app can then also contain some logic to assign different index/sourcetype etc. to the data (as part of the HEC metadata fields). I just noticed someone also built a Splunk App around that approach: https://splunkbase.splunk.com/app/6223 ... View more