Getting Data In

Which add-on for o365 and Azure log collection?

Path Finder

Hi all,

I am planning on integrating o365 and Azure cloud services to my Splunk on-prem environment.

Now there are several Add-Ons to choose from in Splunkase

  • Microsoft Azure Add on for Splunk
  • Splunk Add-on for Microsoft Office 365
  • Splunk Add-on for Microsoft Cloud Services

What is the main difference between these Add-Ons and which should i use? The documentation did not really help.

"The Splunk Add-on for Microsoft Office 365 replaces the modular input for the Office 365 Management API within the Splunk Add-on for Microsoft Cloud Services."

  • Is it still possible to collect the o365 logs with the Cloud Services add-on which collects via so called event hubs?

Thank you,


Tags (3)
0 Karma

Path Finder

In case i use both add-on's do I need to create two seperate application integrations?

0 Karma

Path Finder

Thank you for the quick feedback, the guide is helpful but i was more looking into a comparison about what add-on to use.

Is the "Splunk Add-on for Microsoft Cloud Services" able to get the O365 data? Is it advised to use it?

0 Karma



we have used this instructions to setup M365 data collection and presentation. This guide is little bit outdated, but you could manage configuration with small modifications.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...