Which log types can be read form Azure Event hub with Splunc Addon for Microsoft Services?

[micnhs]

Hi Community, 

We think about how to transfer log information from azure to Splunk. We would like to forward all relevant log information like Activity Logs, Diagnostic logs, Security Center logs to Event hub. Can the splunk addon read all log types  or only a view of them? Will the log data be stored in json raw data or fully parsed?

[aasabatini]

Hi @micnhs 

Please read this post, it is really exhaustive for your question.

https://www.splunk.com/en_us/blog/tips-and-tricks/getting-microsoft-azure-data-into-splunk.html

Alessandro

[micnhs]

Hi @aasabatini 
Thanks for the blog post. 
I'm not sure if I understand it right. If we forward Diagnostic logs for example to the Event hub. Does it mean that the Addon will not read these logs from it or will they just read and store them as raw data, but not properly parsed, to enable search and indexing?

[aasabatini]

Hi @micnhs 

Activity Log and Diagnostic Log data inputs use AMQP to connect to event hub over TLS using ports 5671 / 5672 as described in the AMQP 1.0 Service Bus and Event Hubs protocol guide. So, if you are having connection/authentication issues, check that these ports are open on your Splunk instance.

please follow these 2 tutorial

https://www.splunk.com/blog/2018/04/20/splunking-microsoft-azure-monitor-data-part-1-azure-setup.htm

https://www.splunk.com/blog/2018/05/07/splunking-microsoft-azure-monitor-data-part-2-splunk-setup.ht