Splunk Add-on for Microsoft Cloud Services

[anandhalagarasa]

We are planning to pull the Azure Audit logs into Splunk so we want to know which one be the recommended solution.

Is this App (Splunk Add-on for Microsoft Cloud Services) can be installed in a Search Head or an Indexer or a Heavy Forwarder?

Kindly provide us with the recommended solution so we will install the same and pull the logs into Splunk.

[adonio]

Best will be the Heavy Forwarder, if you can not go that route, use the Search Head. dont forget to have outputs.conf on the Search Head.
do not install the app for MSCS (or any modular input app) on the Indexer (the only exception is if its "all in one" splunk)

hope it helps