If we are only adding an event hub input using the Microsoft Azure Add-on for Splunk, do we need to include account information on the configuration tab?
We haven't put in any account information on the configuration tab and are only using an event hub input, but we aren't seeing any data coming in.
You do not need the account information for the Event Hub input. The account information is necessary for the other inputs as they use REST APIs, and the account is used to authenticate to those APIs. The Event Hub input only needs the connection string (no account).
You do not need the account information for the Event Hub input. The account information is necessary for the other inputs as they use REST APIs, and the account is used to authenticate to those APIs. The Event Hub input only needs the connection string (no account).
Any other places to check as to why we are not seeing data come in to Splunk?
Here are the 3 most common issues:
Thanks Jason. It appears that our problem might be firewall related.
Confirmed that this all works after the firewall was opened up. We had to open our heavy forwarder to be able to reach port 5671.
What is your splunk version? I am having issue but my splunk is also in Azure and I am on 8.0.3 version.
Our Splunk version is 7.2.7. The event hub collector is not compatible with Splunk 8. See @jconger response above.