I have one instance setup successfully and its pulling down data. But I haven't instance that is not working. i get the following events in ta_ms_aad_azure_event_hub.log 2020-05-09 04:44:18,079 INFO pid=7997 tid=MainThread file=connectionpool.py:new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 2020-05-09 04:44:18,912 INFO pid=7997 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 2020-05-09 04:44:19,548 INFO pid=7997 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 2020-05-09 04:44:20,655 INFO pid=7997 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 2020-05-09 04:44:21,757 INFO pid=7997 tid=MainThread file=setup_util.py:log_info:114 | Log level is not set, use default INFO 2020-05-09 04:44:21,758 INFO pid=7997 tid=MainThread file=setup_util.py:log_info:114 | Proxy is not enabled! 2020-05-09 04:44:21,758 INFO pid=7997 tid=MainThread file=client_abstract.py:init_:161 | u'eventhub.pysdk-008cb880': Created the Event Hub client 2020-05-09 04:44:21,762 INFO pid=7997 tid=MainThread file=connection.py:_state_changed:177 | Connection '6d677b52-1575-4388-9bbf-dc0f791dcf08' state changed from to 2020-05-09 04:44:21,921 INFO pid=7997 tid=MainThread file=connection.py:_state_changed:177 | Connection '6d677b52-1575-4388-9bbf-dc0f791dcf08' state changed from to 2020-05-09 04:44:21,943 INFO pid=7997 tid=MainThread file=connection.py:work:259 | 'Closing tlsio from a state other than TLSIO_STATE_EXT_OPEN or TLSIO_STATE_EXT_ERROR' I see from other posts this is often a wrong primary or secondary key but I'm using the copy to clipboard icon under RootManageSharedAccessKey and pasting into the connection string field. I've tried both primary and secondary many times. For the eventhub, I've gone to the namespace, clicked eventhubs under entities and copied my only configured eventhub. I believe I've used the same process as the input that's working. Comparing tcpdump between the 2 connections, I see traffic both ways on port 5671. But at the point the one stops, the successful connection has some kind of TLS exchange... This is part of that packet: Washington1.0...U....Redmond1.0...U. ..Microsoft Corporation1.0...U....Microsoft IT1.0...U....Microsoft IT TLS CA 40... Ehttp://www.microsoft.com/pki/mscorp/Microsoft%20IT%20TLS%20CA%204.crt0"..+.....0...http://ocsp.msocsp.com So I'm using Microsoft Azure Add on for Splunk version 2.02 (I've tried 2.10 as well) I'm using Splunk Enterprise Version 7.1.7 (also tried Splunk 7.3.5) Any suggestions on what I can check or do to fix?? thank you... ... View more