Event Hubs Modular Input for Splunk
Event Hubs Modular Input for Splunk is a very simple modular input that ingests data from Azure Event Hubs. It also supports IoT Hub via their Event Hub compatible endpoint.
It is best to set up a new consumer group for Splunk - if you re-use a consumer group that is also being used with Event Processor Host, you'll see errors about epochs.
If your data are structured in a way that you want to split into multiple
messages or transform or enrich before importing into Splunk, you can add and
use a custom processing class. By default all inputs use
default_message_handler.js but you can create a new class in the bin/app/
directory and specify the name in the input, e.g. create
and set the input's
custom_handler. The handleMessage
function is called once per Event Hub message.
- Set the
SPLUNK_HOMEenvironment variable to the root directory of your Splunk instance.
Copy this whole
Open a terminal at
Adding an input
- From Splunk Home, click the Settings menu. Under Data, click Data inputs, and find
Event Hubs. Click Add new on that row.
- Click Add new and fill in:
name(the name you want to give this input)
connection_string(the connection string for an Event Hub or an IoT Hub's Event Hub compatible endpoint
consumer_group(the name of the Event Hub consumer group)
custom_filter(an AMQP filter string)
- Save your input, and navigate back to Splunk Home.
To connect to an IoT Hub, find the endpoint through Azure Portal under IoT Hub -> Endpoints -> Events -> Event Hub-compatible endpoint. You will also need to append EntityPath= and the Event Hub-compatible name, which is found in the field above.