Splunk Add-on for Microsoft Cloud Services vs Microsoft Azure Add on for Splunk

[adalbor]

Can anyone tell me what the key difference(s) is between the Splunk Add-on for Microsoft Cloud Services vs the Microsoft Azure Add on for Splunk? Looking at the splunkbase descriptions they look almost identical in what data sources they can collect? Is the only difference that the Splunk Add-On can pull in blob storage logs? Or is there something else I am missing?

Thanks,

Andrew

[grobendg · Accepted solution]

One key difference is Eventhub ingestion.

Microsoft Azure Add on for Splunk (now deprecated)
-> ingests Eventhubs through old ClientSecret String

Splunk Add-on for Microsoft Cloud Services
-> ingests Eventhubs through modern Azure-AD app with Reader rights into eventhub

[venkatasri]

Hi @adalbor 

As you said MSCS add-on mainly covers the storage & resource data collection using Azure Service Management APIs and Azure Storage APIs . Where as Azure add-on uses different set of API for data collection.

As per docs they both built to work for different purpose looking at the comment here - Microsoft Azure Add on for Splunk | Splunkbase

* Improved compatibility with the Splunk Add-on for Microsoft Cloud Services

Azure-add on having more coverage of data collection than MSCS. I could not find Azure add-on doc link to find the differences in sourcetypes that's the good place to find if there are common data types i guess not.

----

An upvote would be appreciated if it helps!

[adalbor]

Thanks for the reply. I figured they were similar but there wasn't any true differences breakdown.  I saw the note that it improved compatibility and that's what confused me. It made it seem like it needed MSCS to operate yet they almost collected identical data sets.