All Apps and Add-ons

Microsoft Azure Add-on for Splunk: Why isn't data coming in using event hub input only (is account info required for configuration)?

tvanry
Engager

If we are only adding an event hub input using the Microsoft Azure Add-on for Splunk, do we need to include account information on the configuration tab?

We haven't put in any account information on the configuration tab and are only using an event hub input, but we aren't seeing any data coming in.

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

You do not need the account information for the Event Hub input. The account information is necessary for the other inputs as they use REST APIs, and the account is used to authenticate to those APIs. The Event Hub input only needs the connection string (no account).

View solution in original post

jconger
Splunk Employee
Splunk Employee

You do not need the account information for the Event Hub input. The account information is necessary for the other inputs as they use REST APIs, and the account is used to authenticate to those APIs. The Event Hub input only needs the connection string (no account).

tvanry
Engager

Any other places to check as to why we are not seeing data come in to Splunk?

0 Karma

jconger
Splunk Employee
Splunk Employee

Here are the 3 most common issues:

  • Using a Splunk 8 instance - the Event Hub input does not work on Splunk 8 (yet)
  • Entering an Event Hub key instead of an Event Hub connection string

alt text

  • Entering an Event Hub Namespace instead of an individual Event Hub Name

alt text

0 Karma

tvanry
Engager

Thanks Jason. It appears that our problem might be firewall related.

0 Karma

tvanry
Engager

Confirmed that this all works after the firewall was opened up. We had to open our heavy forwarder to be able to reach port 5671.

0 Karma

rluhar_fs
Explorer

What is your splunk version? I am having issue but my splunk is also in Azure and I am on 8.0.3 version.

0 Karma

tvanry
Engager

Our Splunk version is 7.2.7. The event hub collector is not compatible with Splunk 8. See @jconger response above.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...