Getting Data In

ta_ms_aad_azure_event_hub events are not pulled from Azure Event Hub

rayar
Contributor

I have defined eventhub_splunk_dev01event hub on HF  , no events are pulled 

please assist 

 

[azure_event_hub://eventhub_splunk_dev01]
connection_string = ********
consumer_group = $Default
event_hub_name = insights-activity-logs
event_hub_timeout = 5
index = test
interval = 60
max_batch_set_iterations = 100
max_batch_size = 100
number_of_threads = 4
source_type = azure:eventhub
disabled = 1

[splunk@ilissplfwd06 local]$

 

[splunk@ilissplfwd06 splunk]$ /bin/telnet 10.67.37.117 5671
Trying 10.67.37.117...
Connected to 10.67.37.117.
Escape character is '^]'.
^CConnection closed by foreign host.
[splunk@ilissplfwd06 splunk]$ /bin/telnet 10.67.37.117 5672
Trying 10.67.37.117...
Connected to 10.67.37.117.

 

No errors in the log , only the below messages  

 

2020-10-29 16:08:41,971 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=__init__.py:deinitialize:170 | Deinitializing platform.
2020-10-29 16:08:41,971 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Deallocating 'SymbolValue'
2020-10-29 16:08:41,971 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Destroying 'SymbolValue'
2020-10-29 16:08:41,972 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Deallocating 'LongValue'
2020-10-29 16:08:41,972 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Destroying 'LongValue'
2020-10-29 16:08:41,972 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Deallocating cSource
2020-10-29 16:08:41,972 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Destroying cSource
2020-10-29 16:08:41,972 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Deallocating 'StringValue'
2020-10-29 16:08:41,972 DEBUG pid=23998 tid=ThreadPoolExecutor-0_0 file=thread.py:run:63 | Destroying 'StringValue'
2020-10-29 16:08:42,008 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating cSession
2020-10-29 16:08:42,008 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating CBSTokenAuth
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating Connection
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating SASLMechanism
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating cSession
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating CBSTokenAuth
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating Connection
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating SASLMechanism
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating cSession
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating CBSTokenAuth
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating Connection
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,009 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating SASLMechanism
2020-10-29 16:08:42,010 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating cSession
2020-10-29 16:08:42,010 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating Connection
2020-10-29 16:08:42,010 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating CBSTokenAuth
2020-10-29 16:08:42,010 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,010 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating XIO
2020-10-29 16:08:42,010 DEBUG pid=23998 tid=Dummy-1 file=(unknown file):(unknown function):0 | Deallocating SASLMechanism
~

 

 


Escape character is '^]'.
^C^X
Connection closed by foreign host.
[splunk@ilissplfwd06 splunk]$

 

the ports are opened to Private EndPoint  

 

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...