Can anyone tell me what the key difference(s) is between the Splunk Add-on for Microsoft Cloud Services vs the Microsoft Azure Add on for Splunk? Looking at the splunkbase descriptions they look almost identical in what data sources they can collect? Is the only difference that the Splunk Add-On can pull in blob storage logs? Or is there something else I am missing?
Thanks,
Andrew
One key difference is Eventhub ingestion.
Microsoft Azure Add on for Splunk (now deprecated)
-> ingests Eventhubs through old ClientSecret String
Splunk Add-on for Microsoft Cloud Services
-> ingests Eventhubs through modern Azure-AD app with Reader rights into eventhub
One key difference is Eventhub ingestion.
Microsoft Azure Add on for Splunk (now deprecated)
-> ingests Eventhubs through old ClientSecret String
Splunk Add-on for Microsoft Cloud Services
-> ingests Eventhubs through modern Azure-AD app with Reader rights into eventhub
Hi @adalbor
As you said MSCS add-on mainly covers the storage & resource data collection using Azure Service Management APIs and Azure Storage APIs . Where as Azure add-on uses different set of API for data collection.
As per docs they both built to work for different purpose looking at the comment here - Microsoft Azure Add on for Splunk | Splunkbase
* Improved compatibility with the Splunk Add-on for Microsoft Cloud Services
Thanks for the reply. I figured they were similar but there wasn't any true differences breakdown. I saw the note that it improved compatibility and that's what confused me. It made it seem like it needed MSCS to operate yet they almost collected identical data sets.