Azure Monitor collects metrics and logs across many different resource types. For example, if you want to view CPU and memory metrics for all App Service Plans across all subscriptions, how would you typically do that? As far as I know, most approaches require exporting this data into Splunk and then querying it from there.
But what if we had a solution that lets Splunk query Azure Monitor data directly, in real time—without ingestion? Data would remain live in Azure, and Splunk would simply query it on demand, giving us more flexibility and control.
Think about scenarios where you want to run the same query across multiple Log Analytics workspaces. This solution makes that possible as well.
Personally, I prefer Splunk’s alerting capabilities over Azure’s. If we can query Azure Monitor data directly, we can also leverage Splunk alerts without needing to ingest anything first.
If anyone is interested, I’m happy to share the initial version of the app I’ve built.
