Splunk® Supported Add-ons

Splunk Add-on for Microsoft Cloud Services

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Configure Azure Event Hub inputs for the Splunk Add-on for Microsoft Cloud Services

Before you enable inputs, complete the previous steps in the configuration process:

Configure your inputs on the Splunk platform instance responsible for collecting data for this add-on, usually a heavy forwarder. You can configure inputs using Splunk Web, which is a best practice, or by using the configuration files.

The Azure EventHubs input for the Splunk Add-on for Microsoft Cloud Services is not compatible with the Event Hubs input in the Microsoft Azure Add-on for Splunk, when listening to the same Event Hub namespace. The Event hubs input in the Microsoft Azure Add-on for Splunk needs to be disabled for this input to run.

Configure inputs using Splunk Web

Configure your inputs using Splunk Web on the Splunk platform instance responsible for collecting data for this add-on, usually a heavy forwarder.

  1. In the Splunk Add-on for Microsoft Cloud Services, click Inputs.
  2. Click Create New Input and then select Azure Event Hub.
  3. Enter the Name, Azure App Account, Event Hub namespace, Event Hub name, Consumer group, Max Wait Time, Max Batch Size, Transport Type, Interval and Index using the information in the following input parameter table.

Configure inputs using configuration files

Configure your inputs using the configuration files on the Splunk platform instance responsible for collecting data for this add-on, usually a heavy forwarder.

  1. In your Splunk platform deployment, navigate to $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-cloudservices/local.
  2. Create a file named inputs.conf , if it does not already exist.
  3. Add the following stanza:
    [<input_stanza_name>]              
    account = <value>
    consumer_group = <value>
    event_hub_name = <value>
    event_hub_namespace = <value>
    index = <value>
    interval = <value>
    max_batch_size = <value>
    max_wait_time = <value>
    use_amqp_over_websocket = 1
    sourcetype = mscs:azure:eventhub
    
  4. Save and restart the Splunk platform.

Verify that the value listed for account matches the account entry in mscs_azure_event_hubs_inputs.conf.

Input Parameters

Each attribute in the following table corresponds to a field in Splunk Web.

Attribute Corresponding field in Splunk Web Description
input_stanza_name Name A friendly name for your input.
account Azure Account The Azure App account from which you want to collect data.
consumer_group Consumer Group The Azure Event Hub Consumer Group.
event_hub_name Event Hub Name The Azure Event Hub Name.
event_hub_namespace Event Hub Namespace (Fully Qualified Domain Name (FQDN)) The Azure Event Hub Namespace (FQDN).
index Index The index in which to store Azure Event Hub data.
interval Interval The number of seconds to wait before the Splunk platform runs the command again. The default is 3600 seconds.
max_batch_size Max Batch Size The maximum number of events to retrieve in one batch. The default is 300.
max_wait_time Max Wait Time The maximum interval in seconds that the event processor will wait before processing. The default is 300 seconds.
use_amqp_over_websocket Transport Type The switch that allows use of Advanced Message Queuing Protocol (AMQP) over WebSocket. The default is AMQP over WebSocket.
sourcetype Sourcetype The default sourcetype is mscs:azure:eventhub. If you want to change the default sourcetype, the Splunk software detects the time field of the event, which may cause errors in the timestamp field. To prevent this issue, configure the timestamp in the props.conf file, in the SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-cloudservices/local/ directory.
Last modified on 14 May, 2021
PREVIOUS
Enable a saved search
  NEXT
Troubleshoot the Splunk Add-on for Microsoft Cloud Services

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters