Hi Community,
We think about how to transfer log information from azure to Splunk. We would like to forward all relevant log information like Activity Logs, Diagnostic logs, Security Center logs to Event hub. Can the splunk addon read all log types or only a view of them? Will the log data be stored in json raw data or fully parsed?
Hi @micnhs
Please read this post, it is really exhaustive for your question.
https://www.splunk.com/en_us/blog/tips-and-tricks/getting-microsoft-azure-data-into-splunk.html
Alessandro
Hi @aasabatini
Thanks for the blog post.
I'm not sure if I understand it right. If we forward Diagnostic logs for example to the Event hub. Does it mean that the Addon will not read these logs from it or will they just read and store them as raw data, but not properly parsed, to enable search and indexing?
Hi @micnhs
Activity Log and Diagnostic Log data inputs use AMQP to connect to event hub over TLS using ports 5671 / 5672 as described in the AMQP 1.0 Service Bus and Event Hubs protocol guide. So, if you are having connection/authentication issues, check that these ports are open on your Splunk instance.
please follow these 2 tutorial
https://www.splunk.com/blog/2018/04/20/splunking-microsoft-azure-monitor-data-part-1-azure-setup.htm
https://www.splunk.com/blog/2018/05/07/splunking-microsoft-azure-monitor-data-part-2-splunk-setup.ht