Hi,
Do someone have experience using the Splunk Add-on for Azure app, and retrieving Azure Table storage data?
The problem is getting the table data without having a valid DateTime field in the Azure Table. Instead the table has a column using DateTime.Ticks (a 64-bit integer, e.g. 635999855693046079). The provider of the table is a 3rd party, so I'm not able to change this.
I've tried using the Tick field as the *Date/Time Column* in the input setup, no error message is shown when pressing save input, but nothing gets indexed. As a test I made a new table with a standard DateTime column, and this was indexed as expected. So far the only solution I see is to mess around in the *AzureStorageTable.py* script to parse the field correct there, but that's something I'd rather not do.
↧