Send data from Splunk DSP to Azure Event Hubs Using SAS Key (Beta)

You can use the Azure Event Hubs Using SAS Key Connector with a Write to Azure Event Hubs Using SAS Key (Beta) sink function to send data from the Splunk Data Stream Processor (DSP) to an Azure Event Hubs namespace.

You need a Universal license to send data from DSP to Azure Event Hubs. See Licensing for the Splunk Data Stream Processor.

You can reuse the Azure Event Hubs connection for both the Azure Event Hubs using SAS Key source function and the Write to Azure Event Hubs Using SAS Key (Beta) sink function.

This is a beta function and not ready for production.

Before you can use any connector, you must create a connection.

Prerequisites

Outbound ports 5671 and 5672 must be open in the firewalls of all the nodes in the DSP cluster. If these outbound ports are not open, DSP cannot communicate with Azure Event Hubs. Ask your DSP administrator to confirm the port configurations and open the ports if needed.

Steps

1. Click the Connections tab.
2. Click Create new connection.
3. Choose the Azure Event Hubs Using SAS Key Connector.
4. Click Next.
5. Complete the following fields:

   Field	Description
   Connection Name	A unique name for your Azure Event Hubs Using SAS Key connection.
   Description (optional)	Optional. A description of your Azure Event Hubs connection.
   Namespace name	The Event Hubs namespace used to read and write events.
   SAS name	The name of the Shared Access Signature (SAS) key used to authenticate to Azure Event Hubs.
   SAS key	The SAS key used to authenticate to Azure Event Hubs. Your shared access key must have listening privileges for the namespace.

6. Click Save.
7. Optional. If you are editing a connection that's being used by an active pipeline, you must reactivate that pipeline after making your changes.

You can now use your Azure Event Hubs Using SAS Key connection with a Write to Azure Event Hubs Using SAS Key (Beta) sink function to send data to Azure Event Hubs.