The file you edit depends on which parts of the MSCS Add-on you’re using, and the steps here assume you have set up your Azure-side with the correct region etc.:
If you are using the MSO365 part of the MSCS Add-on:
- the o365 login endpoint URL AND the o365 management endpoint API URL is set in
splunk_ta_ms_o365_server_ucc_system_setting.conf
- the o365 management endpoint API URL is set in
splunk_ta_ms_o365_api_settings.conf
Update the URLs to match the Azure Germany endpoints in those two files. Make sure that you update the API URL in both files before you restart to apply changes.
For the rest of the MSCS add-on functionality, these two files should be edited:
mscs_azure_accounts.conf.spec <- Azure Account Setting Schema (For ingesting Azure Audit Events)mscs_storage_accounts.conf.spec <- Azure Storage Account Setting Schema
Find the variable account_class_type and set it to 3 (which should tell it to connect to the German endpoints).
Restart Splunk after changing these settings to apply the changes.
Note, if you’re using the MSCS Add-on for MSO365 data, you should migrate to the standalone MSO365 Add-on that was just recently released. It can live side-by-side with the current MSCS Add-on, but you have to disable the Office 365 modular input in the Splunk Add-on for Microsoft Cloud Service, see: http://docs.splunk.com/Documentation/AddOns/released/MSO365/Releasenotes
