What is the best practice to ingest windows events logs from Azure servers? Do we have to install Splunk Forwarder on Azure servers Or Any other way to get these logs to on-prem splunk?
This might be helpful for anyone visiting; I have started working on an addon for Azure Event Hubs for Splunk, feel free to use it! https://splunkbase.splunk.com/app/4343/
You can use a Universal Forwarder on the VM. But, you can also use the Splunk Add-on for Microsoft Cloud Services. This option does not require a UF installed on the VM. Instead, you configure which logs you want to collect in the Azure Portal and a storage account to write the logs. Then, use the Splunk Add-on for Microsoft Cloud Services to pick up these logs from the storage account and ingest them into Splunk.
Thanks Jason, we ended up ingesting logs using Storage table, but the logs coming are Not CIM compatible and are not extracted, is there a add-on Or any plan to support for this one?
