All Apps and Add-ons

Which log types can be read form Azure Event hub with Splunc Addon for Microsoft Services?

micnhs
Observer

Hi Community, 

We think about how to transfer log information from azure to Splunk. We would like to forward all relevant log information like Activity Logs, Diagnostic logs, Security Center logs to Event hub. Can the splunk addon read all log types  or only a view of them? Will the log data be stored in json raw data or fully parsed?

Labels (2)
Tags (3)
0 Karma

aasabatini
Motivator

Hi @micnhs 

Please read this post, it is really exhaustive for your question.

https://www.splunk.com/en_us/blog/tips-and-tricks/getting-microsoft-azure-data-into-splunk.html

Alessandro

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

micnhs
Observer

Hi @aasabatini 
Thanks for the blog post. 
I'm not sure if I understand it right. If we forward Diagnostic logs for example to the Event hub. Does it mean that the Addon will not read these logs from it or will they just read and store them as raw data, but not properly parsed, to enable search and indexing?

0 Karma

aasabatini
Motivator

Hi @micnhs 

Activity Log and Diagnostic Log data inputs use AMQP to connect to event hub over TLS using ports 5671 / 5672 as described in the AMQP 1.0 Service Bus and Event Hubs protocol guide. So, if you are having connection/authentication issues, check that these ports are open on your Splunk instance.

please follow these 2 tutorial

https://www.splunk.com/blog/2018/04/20/splunking-microsoft-azure-monitor-data-part-1-azure-setup.htm


https://www.splunk.com/blog/2018/05/07/splunking-microsoft-azure-monitor-data-part-2-splunk-setup.ht

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...