Splunk On-Prem lift and shift to Azure

[jmallen1027]

Does anyone provide me some information on doing a lift and shift from on-prem into Azure? Some services will still be on-prem and some would be in Azure. Would we just match our current On-Prem Splunk Requirements to Azure resources? 

What are some best practices for forwarding data from a hybrid environment? Could we send everything to Azure Monitor and then forward it to Splunk and using index and search head clusters.  

The Splunk architecture is using Linux. We have some heavy and universal forwarders sending out data to Splunk. 

Thank you!

[richgalloway]

When you shift to cloud, but wary of data egress charges.  Because of them, you don't want to have search heads on-prem and indexers in the cloud.

Be very careful with your Cloud security settings to make sure your data remains yours.  Allow connections only from your on-prem instances as much as possible.  Consider requiring SSL on all connections.