Splunk Enterprise

Splunk Add-on for Microsoft Cloud Services: Why is data not getting indexed in Splunk?

Ashwini008
Builder

Hi,

I am trying to use this Splunk Add-on for Microsoft Cloud Services on Splunk Enterprise platform.

I have followed all the steps mentioned in the splunk doc Configure a Storage Account in Microsoft Cloud Services - Splunk Documentation

But Data is not getting indexed in Splunk unless i select the highlighted one in below pic in the Azure storage account

Ashwini008_0-1674024075740.png

 Due to company policy i cannot set it to "Enabled from all networks". I have tried raising microsoft support request but didnt get the solution.

I am able to fetch the data from the storage account directly into Virtual Machine using azcopy command but using add on i am not able to index/fetch the data into splunk.

Any help on troubleshooting this issue will be of great help

0 Karma
Get Updates on the Splunk Community!

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...

New This Month - SLO Capabilities, APM Advanced Filtering & Usage Analytics Plus ...

More for SLO Management We’re continuing to expand the built-in SLO management experience in Splunk ...

Enterprise Security Content Update (ESCU) | New Releases

In June, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...