I would like to know what are the specific steps and specific component I'll need to perform/create in order to configure/use Azure Diagnostics Splunk add-on. first from Azure side (e.g. VM with Azure Diagnostics extension ?storage account? Blob storage?), and then also from Splunk side.
I would appreciate if someone can provide a clear step by step to achieve this goal.
Diagnostic logs in Azure is a very broad topic. Almost all services in Azure can expose diagnostic logs in 1 of 2 ways:
In either of the above cases, it involves creating a diagnostic setting in Azure first. The diagnostic setting controls where logs are sent (storage and/or Event Hub). If you send logs to storage, check out this blog on getting the data into Splunk. If you send logs to an Event Hub, refer to these blogs for Azure setup and Splunk setup.