https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343366#M63224 <P>Yes. Assuming you have network connectivity and the hosts in Azure can reach port 8089 on the deployment server.</P> Thu, 14 Dec 2017 15:21:36 GMT baldwintm 2017-12-14T15:21:36Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343359#M63217 <P>Hello,</P> <P>What is the best way to get windows logs and linux logs from aroung 200+ servers in Azure to on-prem splunk environment, I tried the blob storage option but its not in correct format. is it better to Install universal forwarders on cloud servers and forward them to on-prem indexers. any one had similar issue?</P> Tue, 12 Dec 2017 16:46:18 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343359#M63217 kiran331 2017-12-12T16:46:18Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343360#M63218 <P>hello @kiran331,</P> <P>are you using the app for mscs <A href="https://splunkbase.splunk.com/app/3110/#/overview">https://splunkbase.splunk.com/app/3110/#/overview</A><BR /> did you configure the Azure modular input?</P> Tue, 12 Dec 2017 17:48:28 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343360#M63218 adonio 2017-12-12T17:48:28Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343361#M63219 <P>Yes, I'm getting the Azure audit logs and resource logs, I'm looking for security, system and application logs from the windows servers in azure</P> Tue, 12 Dec 2017 17:50:48 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343361#M63219 kiran331 2017-12-12T17:50:48Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343362#M63220 <P>looks like you are on the right track, <BR /> read here:<BR /> <A href="https://www.splunk.com/blog/2016/03/15/splunking-microsoft-azure-data.html">https://www.splunk.com/blog/2016/03/15/splunking-microsoft-azure-data.html</A><BR /> did you enable the correct audit rules on your azure account?<BR /> check out these links: (also directly from article above)<BR /> <A href="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-overview-of-diagnostic-logs">https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-overview-of-diagnostic-logs</A><BR /> <A href="https://msdn.microsoft.com/en-us/library/azure/dn931934.aspx">https://msdn.microsoft.com/en-us/library/azure/dn931934.aspx</A></P> <P>hope it helps</P> Tue, 12 Dec 2017 17:57:37 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343362#M63220 adonio 2017-12-12T17:57:37Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343363#M63221 <P>Hey Kiran!</P> <P>I will be working with the MS Azure team shortly after the new year to ensure that Splunking Azure gets the first class treatment like we have in AWS! Once I have met with them I will be sure to check back with you. Until then, let us know what you find!</P> Wed, 13 Dec 2017 14:14:01 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343363#M63221 mattymo 2017-12-13T14:14:01Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343364#M63222 <P>I’ve found that the best way to get logs from servers in azure is to install the universal forwarder on the instances. </P> Thu, 14 Dec 2017 00:03:47 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343364#M63222 baldwintm 2017-12-14T00:03:47Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343365#M63223 <P>are you able to manage forwarders with on-prem deployment server?</P> Thu, 14 Dec 2017 15:17:45 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343365#M63223 kiran331 2017-12-14T15:17:45Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343366#M63224 <P>Yes. Assuming you have network connectivity and the hosts in Azure can reach port 8089 on the deployment server.</P> Thu, 14 Dec 2017 15:21:36 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343366#M63224 baldwintm 2017-12-14T15:21:36Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343367#M63225 <P>Is it a best practice to talk to 8089 over internet with public Ip?</P> Thu, 14 Dec 2017 15:31:44 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343367#M63225 kiran331 2017-12-14T15:31:44Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343368#M63226 <P>That's a good question. <BR /> It's https, so it would be encrypted, but then getting the data back to the indexers would be a little interesting.</P> <P>I'm not sure I have a good answer for you</P> Thu, 14 Dec 2017 15:43:33 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343368#M63226 baldwintm 2017-12-14T15:43:33Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343369#M63227 <P>Yep you could do this, it would just be a good idea to flip off of Splunk default certs to 3rd party or self-signed certs for both the management port (8089) and for the forwarding layer (ie. 9997)</P> Thu, 14 Dec 2017 19:02:00 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343369#M63227 mattymo 2017-12-14T19:02:00Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343370#M63228 <P>I would recommend installing UF on the servers and forward the logs to your Splunk instance, that way you also have better control on how you want to parse the data. Using the blob storage may not give that flexibility. </P> Mon, 18 Dec 2017 11:03:50 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/343370#M63228 varadredgntn 2017-12-18T11:03:50Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/680135#M113631 <P>Looking for the solution. Would you mind if you resolve this issue, getting&nbsp; Azure applciaion log to On-prem Splunk</P> Sat, 09 Mar 2024 00:03:17 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-Logs-from-Azure-servers-to-On-prem-splunk/m-p/680135#M113631 ppadhi01 2024-03-09T00:03:17Z