Splunk® Data Stream Processor

Function Reference

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Get data from Microsoft Azure Event Hubs

Use the Microsoft Azure Event Hubs source function to get data from an Azure Event Hubs namespace. You must create a connection to use this source function. See Create a connection to Microsoft Azure Event Hubs. For information on how to create a pipeline using Azure Event Hubs as your data source, see Deserialize and preview data from Microsoft Azure Event Hubs.

Function output schema

This function outputs records with the schema described in the following table.

Key Description
partitionKey The partition key of the event as a string.
body The payload of the event in bytes.
partitionId The ID of the partition in the event hub where the event is stored, given as a string.
offset The offset of the event as a string.
sequenceNumber The sequence number of the event as a long.
enqueuedTime The date and time when the event was queued up for delivery to subscribers, given as a long.
properties The user-defined properties associated with the event, given as a map of strings.

The following is an example of a typical record from the event_hubs function:

"partitionKey": "1",
"body": "aGVsbG8gd29ybGQ=",
"partitionId": "1",
"offset": "8589944464",
"sequenceNumber": 83,
"enqueuedTime": 1598479296172,
"properties": {
     "MyProperty": "TestVal"

Required arguments

Syntax: string
Description: The ID of your Azure Event Hubs connection.
Example: "576205b3-f6f5-4ab7-8ffc-a4089a95d0c4"
Syntax: string
Description: The name of the Event Hub entity to subscribe to.
Example: "my-event-hub-name"
Syntax: string
Description: The name of a consumer group. This must match the consumer group name as defined in Azure Event Hubs. If the consumer group does not exist, the pipeline will fail. Consumer groups are limited to 5 concurrent readers. To avoid reaching this limit, create a new, dedicated consumer group for each pipeline.
Example: "my-consumer-group"
Description: The position in the data stream where you want to start reading data. Set this argument to one of the following values:
  • LATEST: Start reading data from the latest position on the data stream.
  • EARLIEST: Start reading data from the very beginning of the data stream.
Example: LATEST

SPL2 example

You can write the function by providing the arguments in this exact order.

| from event_hubs("my-connection-id", "my-event-hub-name", "my-consumer-group", "LATEST") | ...;

Alternatively, you can use named arguments to list the arguments in any order. See the "Named arguments" section in SPL2 syntax for more details. The following example uses named arguments to list the arguments in an arbitrary order.

| from event_hubs(starting_position: "LATEST", event_hub_name: "my-event-hub-name", connection_id: "my-connection-id", consumer_group_name: "my-consumer-group") |...;
Last modified on 06 November, 2020
Get data from Microsoft 365
Get data from Microsoft Azure Monitor

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters