The current implementation sends one HTTP request to HEC per Event Hub message:
for (const event of eventHubMessages) {
await splunk.sendToHEC(event, ...) // One HTTP call per event
}
Under high volume, this can overwhelm Splunk Heavy Forwarders/HEC endpoints.
Proposed Fix
Batch all events from the Event Hub trigger into a single HEC payload before sending.
HEC supports concatenated JSON events in one request.
Impact
- Reduce HTTP overhead
- Improve throughput
- Reduce load on Splunk infrastructure