I attended the 2017 .conf presentation by John Kemnetz and Greg Oliver of Microsoft: http://conf.splunk.com/files/2017/recordings/monitor-and-manage-your-cloud-environment-with-azure-mo...
At .conf I was told by representatives of both Splunk and Microsoft that Microsoft is 100% committed to integration with Splunk and that there is a roadmap to merge the two apps in SplunkBase for into a single holistic supported integration.
This app seems to have a better approach (in my opinion) to logging and I am attempting to demo it now but I've encountered some issues with the installation and am not able to find support for those issues (hence my ending up here). Perhaps if the 30 or so people who have viewed this topic make some noise we will get that support.
The issue with the current Splunk built and supported app is that Splunk cannot provide any specific information as to precisely what their app is built to ingest (the answer is everything currently available in the API...) and thus there is no way to validate that the app is performing as expected.
On numerous occasions, logging in to the Azure portal and browsing audit logs produces evidence of activities which cannot be similarly located in the logs ingested into Splunk. This is a similarly dis-satisfying level of support even for a "supported" app.
@Splunk - what is the roadmap for seriously addressing logging for Microsoft Cloud (O365 and Azure) and what level of support will be provided?
@marycordova
