Getting Data In

Recommended way to ingest files from remote server into clustered indexers?

jwalzerpitt
Motivator

We have a clustered search head and indexer environment with 16 indexers and a Deployment server

On a remote Windows server we have a PS script that runs a Microsoft API call every hour to pull alerts from Azure and then dumps the output into a .csv file on that Windows server. This server is not running a UF.

I’m not seeing any of the four/five Azure add-ons that pull the Azure AD related alerts so with that I would like to assistance in pulling those .csv files into an index on Splunk.

Is the best way to get the files from the remote Windows server via a UF that is set to monitor the ,csv files in the directory?

Thx

0 Karma
1 Solution

wmyersas
Builder

Yes - the best way to get data into Splunk is via the UF

Or using HEC - which might be simpler in this case (would need to know more about your use cases to know for sure)

View solution in original post

wmyersas
Builder

Yes - the best way to get data into Splunk is via the UF

Or using HEC - which might be simpler in this case (would need to know more about your use cases to know for sure)

jwalzerpitt
Motivator

Thx for the reply.

Our use case is ingesting Azure alerts. I've combed the various Azure add-ons and even referenced this solid doc - https://docs.google.com/spreadsheets/d/139tuKUqqXqPp1yzCvH60LZfDThz067rLzYSAdHzomxo/edit#gid=0 - and there is no add-on that specifically lists Azure alerts as a sourcetype.

We have a PowerShell script that makes an API call every hour and pulls the events down and dumps them into a .csv file. I can probably easily install a UF on the server.

I plan on taking a look at Azure Event Hub to see if I can centralize all relevant Azure logs there and then pull the events from Event Hub into Splunk, but that's a bit in the future.

Thx

0 Karma

wmyersas
Builder

You could probably just have your PS script push to the HEC

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...