Hi,
Currently I have an issue with the Splunk add-on for Microsoft Cloud Services.
I have 4 Azure accounts which I want to collect Audit logs from and I have configured them in mscs_azure_accounts.conf
[Azure Test]
account_class_type = 1
client_id = client_id
client_secret = clientSecret
tenant_id = tenant_id
[Azure Acceptance]
account_class_type = 1
client_id = client_id
client_secret = client_secret
tenant_id = tenant_id
[Azure Production]
account_class_type = 1
client_id = client_id
client_secret = client_secret
tenant_id = tenant_id
[Azure Services]
account_class_type = 1
client_id = client_id
client_secret = client_secret
tenant_id = tenant_id
We have 1 Heavy forwarder in our Services environment which collects the information.
What I noticed is that the addon only collects information from the [Azure Services] environment, which is the latest entry in the conf file as shown above.
Each account has been tested seperatly so I know the accounts are working fine.
I haven't found a post saying or an entry in the documentation pointing out that you can only have 1 account in the accounts config.
Did anyone else has seen this and if so, how did you solve this ?
I found the issue. In the mscs_azure_audit_inputs.conf file for each section it had the same section name
[Audit Logs]
account=Azure Test
[Audit Logs]
account=Azure Acceptance
[Audit Logs]
account=Azure Production
[Audit Logs]
account=Azure Services
Changing this to
[Audit Logs Test]
account=Azure Test
[Audit Logs Acceptance]
account=Azure Acceptance
[Audit Logs Production]
account=Azure Production
[Audit Logs Services]
account=Azure Services
Solved the issue