Azure Add-on API method for sending logs to Splunk not working.

Question

Azure Add-on API method for sending logs to Splunk not working.

Sivakalyan Sivakalyan 0

We configured the Azure using Microsoft cloud Add-on API method to forward logs from Azure to Splunk. However, logs are not being sent. We followed the standard setup but still no logs are appearing in Splunk. Need your assistance in troubleshooting and validating the configuration.

Attached a screenshot of log flowing to event hub but not reflecting in Splunk. Kindly revert ASAP.

Logs.PNG

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Christos Panagiotidis 3,546 Reputation points

2026-07-29T11:09:25.74+00:00

Because events are visible in Event Hubs, the Azure producer and diagnostic setting are working; the failure is between the Event Hub consumer and Splunk indexing. In the Microsoft Cloud Services Add-on, verify the exact namespace, Event Hub name, connection credentials, and consumer group. Use a dedicated consumer group for Splunk so another consumer cannot take its partition ownership.

Confirm the SAS policy includes Listen permission, or assign Azure Event Hubs Data Receiver when using Microsoft Entra authentication. Review Splunk’s internal logs for authorization, DNS, AMQP, checkpoint, or indexing errors. Check that the Splunk host can reach the Event Hubs endpoint on the configured transport and that Event Hubs firewall or private-endpoint rules permit it. Validate the checkpoint storage account and container credentials as well. For a clean test, create a new dedicated consumer group and send a uniquely identifiable event. If consumer lag decreases but no searchable event appears, investigate the Splunk index, sourcetype, timestamp parsing, and search-time range rather than Azure delivery.ce
Sina Salam 31,216 Reputation points Volunteer Moderator

2026-07-29T14:40:44.8033333+00:00

Hello Sivakalyan Sivakalyan,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that your Azure Add-on API method for sending logs to Splunk not working.

The failure point is the Splunk consumer path from Event Hub to Splunk, specifically the Splunk Add-on Event Hub input configuration, Microsoft Entra authorization, network transport, checkpoint behavior, or Splunk index visibility. - https://learn.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings, https://learn.microsoft.com/en-us/azure/azure-monitor/platform/stream-monitoring-data-event-hubs

What to do is to configure Splunk as a valid Event Hub consumer. Assign the Microsoft Entra application used by the Splunk Add-on the Azure Event Hubs Data Receiver role on the Event Hub or namespace, because that role is required for receiving events from Event Hubs. Then configure the Splunk Add-on for Microsoft Cloud Services with the exact Event Hub namespace FQDN, Event Hub name, consumer group, transport type, target index, and correct sourcetype. The Event Hub namespace must be in the format <namespace>.servicebus.windows.net, not a connection string. - https://learn.microsoft.com/en-us/azure/event-hubs/authorize-access-azure-active-directory, https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/Configureeventhubs/

If Splunk Cloud or a restricted network is used, ensure the collector can reach Event Hubs using the required transport. Microsoft documents that outbound ports 5671 and 5672 must be open for machines or networks consuming Event Hub data, while the Splunk Add-on also supports AMQP over WebSocket through use_amqp_over_websocket = 1.

After correcting permissions and configuration, disable and re-enable the Splunk Event Hub input or restart the Splunk collector so the latest account and proxy settings are loaded. - https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/Troubleshoot/

Azure Support is only required via your Azure Portal, if Azure Monitor diagnostic settings are correctly configured but Event Hub receives no data after the expected diagnostic export window. - https://learn.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings

I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.

Christos Panagiotidis 3,546 Reputation points

2026-07-29T11:09:25.74+00:00

Because events are visible in Event Hubs, the Azure producer and diagnostic setting are working; the failure is between the Event Hub consumer and Splunk indexing. In the Microsoft Cloud Services Add-on, verify the exact namespace, Event Hub name, connection credentials, and consumer group. Use a dedicated consumer group for Splunk so another consumer cannot take its partition ownership.

Confirm the SAS policy includes Listen permission, or assign Azure Event Hubs Data Receiver when using Microsoft Entra authentication. Review Splunk’s internal logs for authorization, DNS, AMQP, checkpoint, or indexing errors. Check that the Splunk host can reach the Event Hubs endpoint on the configured transport and that Event Hubs firewall or private-endpoint rules permit it. Validate the checkpoint storage account and container credentials as well. For a clean test, create a new dedicated consumer group and send a uniquely identifiable event. If consumer lag decreases but no searchable event appears, investigate the Splunk index, sourcetype, timestamp parsing, and search-time range rather than Azure delivery.ce