How does Splunk Add-on for Microsoft Cloud Services query table storage?

[cathaladams21]

There is an associated cost when querying table storage in Azure. Does anyone who how the Add-on queries the tables? Does it use Partition Key or row Key?

Thanks,
Cathal

[marycordova]

I'm not sure what you are trying to get out of table storage, but I developed what I consider to be a superior method of ingestion if the events you are trying to get can be made available to Log Analytics instead of table storage.

(This would be for Azure logging but I've not yet had to try to get internal application logging from 3rd party apps running in Azure.)

https://answers.splunk.com/answers/678660/how-to-get-logs-from-azure-and-o365-into-splunk.html