Azure Splunk Account

[jwhughes58]

I've read through Ryan Lait's blogs "Splunking Microsoft Cloud Data" and it answers everything but what permissions does the account need on the Azure side. I keep finding this error in the MS Azure Blob log

2018-05-17 20:54:25,199 +0000 log_level=ERROR, pid=11729, tid=Thread-9, file=mscs_storage_dispatcher.py, func_name=_dispatch_storage_list, code_line_no=86 | [stanza_name="kp_azure_dev_blob" account_name="kpsactoaladevtest01" container_name="sqldbtdlogs" blob_list="kpsqmmsbmetastoreuscn01"] Exception@_dispatch_tables() ,error_message=This request is not authorized to perform this operation using this permission.

Since I don't control the Azure permissions, I need to know what permissions the account needs in order for the Azure team to give the correct permissions.

[jconger · Accepted solution]

It sounds like you are using a shared access signature (SAS) for access based on your error message.

For allowed services, you will need:

• Blob (based on your input)
• Table (if you are using a table input)

For Allowed resource types, you will need:

• Service, Container, and Object

For allowed permissions, you will need:

• Read
• List

Make sure the start and expire times are set accordingly and that your IP address is listed as allowed (if used).

[jwhughes58]

And as a side note the other problem was the Splunk TA lives on an internal network. Azure needs the NAT'ed IP in order to generate the correct SAS.