All Apps and Add-ons

Which log types can be read form Azure Event hub with Splunc Addon for Microsoft Services?

micnhs
Observer

Hi Community, 

We think about how to transfer log information from azure to Splunk. We would like to forward all relevant log information like Activity Logs, Diagnostic logs, Security Center logs to Event hub. Can the splunk addon read all log types  or only a view of them? Will the log data be stored in json raw data or fully parsed?

Labels (2)
Tags (3)
0 Karma

aasabatini
Builder

Hi @micnhs 

Please read this post, it is really exhaustive for your question.

https://www.splunk.com/en_us/blog/tips-and-tricks/getting-microsoft-azure-data-into-splunk.html

Alessandro

 

0 Karma

micnhs
Observer

Hi @aasabatini 
Thanks for the blog post. 
I'm not sure if I understand it right. If we forward Diagnostic logs for example to the Event hub. Does it mean that the Addon will not read these logs from it or will they just read and store them as raw data, but not properly parsed, to enable search and indexing?

0 Karma

aasabatini
Builder

Hi @micnhs 

Activity Log and Diagnostic Log data inputs use AMQP to connect to event hub over TLS using ports 5671 / 5672 as described in the AMQP 1.0 Service Bus and Event Hubs protocol guide. So, if you are having connection/authentication issues, check that these ports are open on your Splunk instance.

please follow these 2 tutorial

https://www.splunk.com/blog/2018/04/20/splunking-microsoft-azure-monitor-data-part-1-azure-setup.htm


https://www.splunk.com/blog/2018/05/07/splunking-microsoft-azure-monitor-data-part-2-splunk-setup.ht

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!