Splunk® Data Stream Processor

Connect to Data Sources and Destinations with DSP

Acrobat logo Download manual as PDF

On April 3, 2023, Splunk Data Stream Processor will reach its end of sale, and will reach its end of life on February 28, 2025. If you are an existing DSP customer, please reach out to your account team for more information.

All DSP releases prior to DSP 1.4.0 use Gravity, a Kubernetes orchestrator, which has been announced end-of-life. We have replaced Gravity with an alternative component in DSP 1.4.0. Therefore, we will no longer provide support for versions of DSP prior to DSP 1.4.0 after July 1, 2023. We advise all of our customers to upgrade to DSP 1.4.0 before July 1, 2023 in order to continue to receive full product support from Splunk.
This documentation does not apply to the most recent version of Splunk® Data Stream Processor. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Connecting Microsoft Azure Monitor to your DSP pipeline

The Microsoft Azure Monitor connector is planned for deprecation. See the Release Notes for more information.

When creating a data pipeline in Splunk Data Stream Processor, you can connect to Microsoft Azure Monitor and use it as a data source. Azure Monitor helps you understand how your applications are performing, and proactively identifies issues that affect your applications and the resources they depend on. You can get metrics data from Azure Monitor into a pipeline, transform the data as needed, and then send the transformed data out from the pipeline to a destination of your choosing.

To connect to Azure Monitor as a data source, you must complete the following tasks:

  1. Create a connection that allows DSP to access your Azure Monitor data. See Create a DSP connection to Microsoft Azure Monitor.
  2. Create a pipeline that starts with the Microsoft Azure Monitor source function. See the Building a pipeline chapter in the Use the Data Stream Processor manual for instructions on how to build a data pipeline.
  3. Configure the Microsoft Azure Monitor source function to use your Azure Monitor connection. See Get data from Microsoft Azure Event Hubs in the Function Reference manual.

When you activate the pipeline, the source function starts collecting metrics from Azure Monitor. Each metric event is received into the pipeline as a record.

If your data fails to get into DSP, check the connection settings to make sure you have the correct tenant ID, client ID, and client secret for your Microsoft Azure Active Directory (AD) integration application. DSP doesn't run a check to see if you enter valid credentials.

How Microsoft Azure Monitor data is collected

The source function collects data according to the job schedule that you specified in the connection settings. See Scheduled data collection jobs for more information, including a list of the limitations that apply to all scheduled data collection jobs.

The following behavior from the Microsoft Azure Monitor connector might have an impact on the exact timing and scope of your data collection jobs:

  • The connector collects metrics for the finest time-grain available in the Azure metric definition.
  • The first time a scheduled job runs, the connector collects metrics for only one time interval. For all following scheduled jobs, the connector collects metrics from the last execution up to the current time, minus the number of minutes defined by the Delay parameter in the connection settings.
Last modified on 29 March, 2022
Deserialize and preview data from Microsoft Azure Event Hubs in DSP
Create a DSP connection to Microsoft Azure Monitor

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.1, 1.2.2-patch02, 1.2.4, 1.2.5, 1.3.0, 1.3.1

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters