You can use a Universal Forwarder on the VM. But, you can also use the Splunk Add-on for Microsoft Cloud Services. This option does not require a UF installed on the VM. Instead, you configure which logs you want to collect in the Azure Portal and a storage account to write the logs. Then, use the Splunk Add-on for Microsoft Cloud Services to pick up these logs from the storage account and ingest them into Splunk.
Thanks Jason, we ended up ingesting logs using Storage table, but the logs coming are Not CIM compatible and are not extracted, is there a add-on Or any plan to support for this one?