All Apps and Add-ons

Why is Azure Event Hub input in "Splunk add-on for Microsoft Cloud services" connectivity not working in Splunk cloud?

Path Finder

Hi Friends.

I'm using Splunk cloud 9.0. I have installed "Splunk add-on for Microsoft Cloud services" add-on in Heavy forwarder. I want to get data from Azure Event hub. 

I have created Azure app account. I have configured input details. but I'm not getting data to splunk.

I'm getting below error message: 

2022-12-26 10:26:32,874 level=WARNING pid=12124 tid=Thread-2 logger=azure.eventhub._eventprocessor.event_processor | EventProcessor instance '35e1711c-18e6-480f-a203-ee6ec4070fc2' of eventhub 'eh-spyglass-metrics-aks-whsdapedge-eastus2-stg' consumer group 'splunk'. An error occurred while load-balancing and claiming ownership. The exception is AuthenticationError("Management authentication failed. Status code: 401, Description: 'Attempted to perform an unauthorized operation.'\nManagement authentication failed. Status code: 401, Description: 'Attempted to perform an unauthorized operation.'"). Retrying after 11.293821480572925 seconds


I have already raised ticket to add my heavy forwarder server IP to add in the whitelist of Azure event hub.

Could you please assist on this. How to receive data from Azure event hub to splunk?

Thanks in advance.


Labels (3)
0 Karma


I am having the same issue. 

Any ideas on how to fix this issue? 

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...