Splunk Add-on for Microsoft Cloud Services - Sourcetype definition

[Brenny]

Hi, we use the app Splunk Add-on for Microsoft Cloud Services version 5.3.1 on our HeavyForwarder.

We ingest data from an eventhub which is splitted in a lot of eventhub names for different microsoft services (e.x. sharepoint, exchange etc.)

The default sourcetype is "mscs:azure:eventhub" but the data isn't parsed with that. In some forums it was mentioned using the sourcetype "ms:o365:management".

Someone had the same trouble finding the correct sourcetype?

That app itself as a lot of config in props/transforms.

Thanks

[marnall]

According to the docs, you should use the sourcetype based on the configured event hub.

Select the source type based on the configured Event Hub. Supported source types are mscs:azure:eventhub, azure:monitor:aad, azure:monitor:resource and azure:monitor:activity. The default sourcetype is mscs:azure:eventhub

https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/Configureeventhubs/

It seems that this add-on contains a props.conf stanza for the sourcetype "ms:o365:management" to CIM-normalize data from that sourcetype, but it does not contain any inputs.conf or scripts in bin which pull in the data. It is not clear why it is bundled that way. I would expect this CIM-normalizing config to be bundled in an add-on which also pulls the ms:o365:management data.

[Brenny]

The default one "mscs:azure:eventhub" doesn't work at all.
For some other Inputs i used "ms:o365:management" which extracts for some Inputs.

But we have several sources like AzureAD,Exchange and all the other MS products and it's not to clear to me which sourcetype I should use.