Getting Data In
Highlighted

Best way to index Microsoft Azure logs?

Builder

Hi

What is the best practice to ingest windows events logs from Azure servers? Do we have to install Splunk Forwarder on Azure servers Or Any other way to get these logs to on-prem splunk?

0 Karma
Highlighted

Re: Best way to index Microsoft Azure logs?

Splunk Employee
Splunk Employee

You can use a Universal Forwarder on the VM. But, you can also use the Splunk Add-on for Microsoft Cloud Services. This option does not require a UF installed on the VM. Instead, you configure which logs you want to collect in the Azure Portal and a storage account to write the logs. Then, use the Splunk Add-on for Microsoft Cloud Services to pick up these logs from the storage account and ingest them into Splunk.

0 Karma
Highlighted

Re: Best way to index Microsoft Azure logs?

Builder

Thanks Jason, we ended up ingesting logs using Storage table, but the logs coming are Not CIM compatible and are not extracted, is there a add-on Or any plan to support for this one?

0 Karma
Highlighted

Re: Best way to index Microsoft Azure logs?

Path Finder

This might be helpful for anyone visiting; I have started working on an addon for Azure Event Hubs for Splunk, feel free to use it!
https://splunkbase.splunk.com/app/4343/

regards,

0 Karma