All Apps and Add-ons

Where should I install the Splunk Add-on for Microsoft Cloud Services?

Explorer

I'm going to use Splunk on-prem with Azure, by installing Universal Forwarder on the VMs, but still going to use the Add-on for getting Azure audit logs.
Where should I install the add-on?
In addition, do I have to use Heavy forwarder (between the UF and the indexer) in this case?

Thanks

1 Solution

Contributor

install the TA on the search head(s). its not necessary to send to a heavy forwarder but if you dont, you'll need to install on the indexers as well.

http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Install

View solution in original post

0 Karma

Explorer

Thank you ! so I need to install The add-on only on the search head? or also on the heavy forwarder?

0 Karma

Contributor

if you are sending any data to the hf from the ufs then yes install on the heavy forwarder and then you wont have to install on the indexers.

0 Karma

Contributor

install the TA on the search head(s). its not necessary to send to a heavy forwarder but if you dont, you'll need to install on the indexers as well.

http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Install

View solution in original post

0 Karma