Illegal connection string format exception

Symptoms

Error: “Ensure that the Event Hub Connection String or Event Hub parameters are valid."

"This exception is thrown when the Event Hub Connection String or Event Hub information that is provided does not meet the requirements to be a valid connection string. An attempt will be made to query for content at the next retry interval."

Causes

The Event Hub Connection String doesn't match the specifications set by Microsoft. This error can also occur if unexpected characters, such as white space, are copied into the event hub connection string.

Resolving the problem

Follow these steps to resolve your illegal connection string error.

  1. Ensure that the storage account connection string is valid and appears in a similar format to the following example:

    Endpoint=sb://<Namespace Name>.servicebus.windows.net/;SharedAccessKeyName=<SAS Key Name>;SharedAccessKey=<SAS Key>;EntityPath=<Event Hub Name>

  2. When you move the event hub connection string from the Azure portal to IBM QRadar, ensure that no additional white space or invisible characters are added. Alternatively, before you copy the string, ensure that you don't copy any additional characters or white space.