Create an event subscription for the Event Grid system topic

Create an event subscription that forwards blob lifecycle event types to the Azure Storage queue.

Note: In the Controlled Availability release stage, Splunk products may have limitations on customer access, features, maturity, and regional availability. For additional information on Controlled Availability please contact your Splunk representative.

In this step, you create an event subscription that forwards blob lifecycle event types to the Azure Storage queue. For more information about creating event subscriptions, see the Azure Event Grid Documentation: Subscribe to events through portal

Note: This is task 3 of 5 tasks that you must complete to ensure that the Splunk-native data catalog that backs your Microsoft Azure dataset stays in sync with that dataset as it changes over time. See Ensure the Microsoft Azure dataset and its data catalog stay in sync.
  1. On the overview page for the Event Grid system topic that you created in the last step, select + Event Subscription.
  2. On the Basics tab, fill in the Event Subscription Details: Name and Event Schema (select Event Grid Schema).
  3. Review the Topic Details section and confirm that these values are correctly auto populated: Topic Type is set to Storage account, Source Resource is set to the name of your storage account, and Topic Name is set to the name of the Event Grid system topic you created in the previous step.
  4. Under Event Types, select the Filter to Event Types drop-down field and choose the Azure blob lifecycle events you want to subscribe to. At a minimum, select Blob Created and Blob Deleted.
  5. Under Event Details, set Endpoint Type to Storage Queue and ensure that Cross-tenant delivery is Disabled.
  6. Select Configure an endpoint.
  7. In the Queues panel, set Storage account to the name of your storage account and Queue to the name of the Azure storage queue you created in Create an Azure Storage queue. Choose Select.
  8. Restrict events to blobs that match the location of your dataset. Go to the Filters tab, select Enable subject filtering, and put a file path in Subject begins with that follows this pattern: /blobServices/default/containers/container-name/blobs/directory-prefix

    For example, say you have a Microsoft Azure dataset in this location: https://myAzureAccount.blob.core.windows.net/myAzureContainer/warehouse/partitioned/raw-parquet/

    In this case, put this file path in Subject begins with: /blobServices/default/containers/myAzureContainer/blobs/warehouse/partitioned/raw-parquet/

  9. Select Create.
Go to the next step: Grant permission to the Event Grid to write to the storage queue.