New Features for Data Inputs
Data Manager became Data Inputs.
We renamed Data Manager to Data Inputs to better reflect our unified approach to data ingestion. While the name changed, all your existing configurations remain the same.
In Splunk 10.4 and later, a navigation panel consolidates Data Inputs and related features into a single location. From there, you can switch between pages and manage all your data from one place.
Version 1.18.0
| New feature | Description |
|---|---|
| Send data to federated destinations in Machine Data Lake (MDL) |
You can send data to a standard Splunk index or to a Machine Data Lake (MDL) dataset. To send data to MDL, enter a federated destination manually using the |
| Connect to Azure Event Hub using managed identity |
Azure ARM template version 4.7 lets the Azure Function connect to Event Hub using its system-assigned managed identity, so you don't need to configure or maintain a shared-access key for Event Hub. When you upgrade from ARM template version 4.6 to version 4.7, the template removes the old connection string app setting and configures identity-based Event Hub access. See Update Azure data inputs to the newest ARM template version. |
Version 1.18.1
| New feature | Description |
|---|---|
| Migrate CrowdStrike inputs from the Splunk Add-on for CrowdStrike FDR |
Migrate eligible CrowdStrike FDR inputs to Data Inputs in batches, without recreating each input manually. The migration assistant identifies blockers before migration. If you need to resume ingestion through the add-on, roll back the batch to restore its previous configuration. Rollback leaves indexed data unchanged. See Migrate CrowdStrike inputs from the Splunk Add-on for CrowdStrike FDR. |
| Automatically provision connectors for supported inputs |
Create supported pull-based inputs without submitting a separate connector provisioning request. If provisioning is interrupted, select Retry to recover the input without deleting and recreating it. |