topic Re: Can I collect application logs from Azure to Splunk? in Getting Data In

Can I collect application logs from Azure to Splunk?

Koko12345678 — Mon, 27 Aug 2018 08:46:15 GMT

I already know that I can collect application logs into Azure application insight, and use a storage account streaming this data to event hub, but can splunk pull this data? if yes, how can I configure input in Splunk to do that.
If someone has a documentation about that it will be very helpful.

Re: Can I collect application logs from Azure to Splunk?

mayurr98 — Mon, 27 Aug 2018 08:51:12 GMT

Hello

Yes, there are several apps and add-ons that are available to pull data from event hub.
have a look at this app:
https://splunkbase.splunk.com/app/3534/

Also,have a look at this detail documentation:
https://www.splunk.com/blog/2018/04/20/splunking-microsoft-azure-monitor-data-part-1-azure-setup.html

let me know if this helps!

Re: Can I collect application logs from Azure to Splunk?

Koko12345678 — Mon, 27 Aug 2018 13:21:21 GMT

I couldn't see anything that related to Azure application logs.
just activity log, diagnostic logs and metrics

Re: Can I collect application logs from Azure to Splunk?

mayurr98 — Mon, 27 Aug 2018 14:05:42 GMT

well i meant that you can monitor event hub data. so it could be anything this app monitors event hub.If you send application logs to event hub add-on will get data from event hub. you can give it a try.

Another approach is using HTTP event collector.
https://github.com/Microsoft/AzureFunctionforSplunkVS
have a look at this link.
https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitor-stream-monitoring-data-event-hubs#what-can-i-do-with-the-monitoring-data-being-sent-to-my-event-hub

Re: Can I collect application logs from Azure to Splunk?

Koko12345678 — Thu, 30 Aug 2018 10:09:32 GMT

to pull data from Event Hub you need also to configure input on the add-on side, this is why I'm asking if I can configure the add-on to also pull for application logs

Re: Can I collect application logs from Azure to Splunk?

mayurr98 — Thu, 30 Aug 2018 11:58:58 GMT

I have never tried it. But I think Yes you can configure.you can give it a try

Re: Can I collect application logs from Azure to Splunk?

Koko12345678 — Thu, 30 Aug 2018 12:02:20 GMT

ok thanks

Re: Can I collect application logs from Azure to Splunk?

larmesto — Mon, 07 Jan 2019 17:42:04 GMT

This might be helpful for anyone visiting; I have started working on an addon for Azure Event Hubs for Splunk, feel free to use it!
https://splunkbase.splunk.com/app/4343/

regards,

Re: Can I collect application logs from Azure to Splunk?

Paul1896 — Mon, 09 Mar 2020 12:34:22 GMT

Hello larmesto,

is it possible to grab application logs which are stored in an azure event hub as well or only acitivity logs?

Re: Can I collect application logs from Azure to Splunk?

saikiran334 — Mon, 20 Apr 2020 16:10:48 GMT

@Koko12345678, out of curiosity ,
Any how you have application logs in Azure for long term storage , and may i know why again you want to index this data from AZure to Splunk ?( any specific requirement )