All Apps and Add-ons

Which log types can be read form Azure Event hub with Splunc Addon for Microsoft Services?

micnhs
Observer

Hi Community, 

We think about how to transfer log information from azure to Splunk. We would like to forward all relevant log information like Activity Logs, Diagnostic logs, Security Center logs to Event hub. Can the splunk addon read all log types  or only a view of them? Will the log data be stored in json raw data or fully parsed?

Labels (2)
Tags (3)
0 Karma

aasabatini
Motivator

Hi @micnhs 

Please read this post, it is really exhaustive for your question.

https://www.splunk.com/en_us/blog/tips-and-tricks/getting-microsoft-azure-data-into-splunk.html

Alessandro

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

micnhs
Observer

Hi @aasabatini 
Thanks for the blog post. 
I'm not sure if I understand it right. If we forward Diagnostic logs for example to the Event hub. Does it mean that the Addon will not read these logs from it or will they just read and store them as raw data, but not properly parsed, to enable search and indexing?

0 Karma

aasabatini
Motivator

Hi @micnhs 

Activity Log and Diagnostic Log data inputs use AMQP to connect to event hub over TLS using ports 5671 / 5672 as described in the AMQP 1.0 Service Bus and Event Hubs protocol guide. So, if you are having connection/authentication issues, check that these ports are open on your Splunk instance.

please follow these 2 tutorial

https://www.splunk.com/blog/2018/04/20/splunking-microsoft-azure-monitor-data-part-1-azure-setup.htm


https://www.splunk.com/blog/2018/05/07/splunking-microsoft-azure-monitor-data-part-2-splunk-setup.ht

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...