All Apps and Add-ons

Splunk Add-on for Microsoft Cloud Services vs Microsoft Azure Add on for Splunk

adalbor
Builder

Can anyone tell me what the key difference(s) is between the Splunk Add-on for Microsoft Cloud Services vs the Microsoft Azure Add on for Splunk? Looking at the splunkbase descriptions they look almost identical in what data sources they can collect? Is the only difference that the Splunk Add-On can pull in blob storage logs? Or is there something else I am missing?


Thanks,

Andrew

Labels (1)
0 Karma
1 Solution

grobendg
Explorer

One key difference is Eventhub ingestion.

Microsoft Azure Add on for Splunk (now deprecated)
-> ingests Eventhubs through old ClientSecret String

Splunk Add-on for Microsoft Cloud Services
-> ingests Eventhubs through modern Azure-AD app with Reader rights into eventhub

 

View solution in original post

grobendg
Explorer

One key difference is Eventhub ingestion.

Microsoft Azure Add on for Splunk (now deprecated)
-> ingests Eventhubs through old ClientSecret String

Splunk Add-on for Microsoft Cloud Services
-> ingests Eventhubs through modern Azure-AD app with Reader rights into eventhub

 

venkatasri
SplunkTrust
SplunkTrust

Hi @adalbor 

As you said MSCS add-on mainly covers the storage & resource data collection using Azure Service Management APIs and Azure Storage APIs . Where as Azure add-on uses different set of API for data collection.

As per docs they both built to work for different purpose looking at the comment here - Microsoft Azure Add on for Splunk | Splunkbase

* Improved compatibility with the Splunk Add-on for Microsoft Cloud Services

Azure-add on having more coverage of data collection than MSCS. I could not find Azure add-on doc link to find the differences in sourcetypes that's the good place to find if there are common data types i guess not.
 
----
An upvote would be appreciated if it helps!

adalbor
Builder

Thanks for the reply. I figured they were similar but there wasn't any true differences breakdown.  I saw the note that it improved compatibility and that's what confused me. It made it seem like it needed MSCS to operate yet they almost collected identical data sets.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...