topic Does anyone actually have Microsoft Azure Monitor working? in All Apps and Add-ons

Does anyone actually have Microsoft Azure Monitor working?

marycordova — Wed, 21 Feb 2018 20:50:44 GMT

Think you could ping me so we could chat about it? I feel like I've set this up ok but no data... 😕

Re: Does anyone actually have Microsoft Azure Monitor working?

marycordova — Mon, 26 Mar 2018 22:31:48 GMT

so...you have to be on version 6.6+ of splunk and you have to be running this from an azure marketplace splunk enterprise version in your azure subscription...you can then send via outputs.conf to your splunk core...

Re: Does anyone actually have Microsoft Azure Monitor working?

MousumiChowdhur — Fri, 01 Jun 2018 06:06:40 GMT

Hi @marycordovacaa,

Does Splunk 7.0.0 version support this add on because I am not getting any data after doing the configurations?

Thank you!

Re: Does anyone actually have Microsoft Azure Monitor working?

marycordova — Wed, 01 Aug 2018 18:46:01 GMT

hey...i guess i should setup some email notifications so i see these sooner...sorry 😞

anyway, do you have this running on the Azure Marketplace Splunk deployment? it only works there

i do actually have a whole new what of doing this that actually works without using any of the various TAs

ill do a write up and post a link to it for you

Re: Does anyone actually have Microsoft Azure Monitor working?

marycordova — Wed, 01 Aug 2018 22:10:40 GMT

Ok here is the real way to do this 🙂

https://answers.splunk.com/answers/678660/how-to-really-get-logs-from-azure-and-o365-into-sp.html

Re: Does anyone actually have Microsoft Azure Monitor working?

marycordova — Wed, 01 Aug 2018 22:11:09 GMT

Here:

https://answers.splunk.com/answers/678660/how-to-really-get-logs-from-azure-and-o365-into-sp.html

Re: Does anyone actually have Microsoft Azure Monitor working?

jaxjohnny2000 — Wed, 30 Sep 2020 01:55:04 GMT

I'm not sure either. All the instructions say to get the *.SPL file from the packages folder. There is no file there. It should also install to $SPLUNK_HOME/etc/apps/TA-Azure_Monitor. But, there is only a way to clone the zip from GIT, so it actually installs to $SPLUNK_HOME$/etc/apps/AzureMonitorAddonForSplunk-master