The specifications depends on the amount of data ingested per day. The numbers referenced in the question are for an indexer that can ingest up to 300GB/day while supporting a search load. https://docs.splunk.com/Documentation/Splunk/7.2.5/Capacity/Summaryofperformancerecommendations The Splunk free license lets you index up to 500MB per day, so the hardware requirements are much less. ... View more

A new version of the app was uploaded that uses Microsoft Graph -> https://splunkbase.splunk.com/app/3757/ This will retrieve the clientAppUsed field requested. Note that this add-on requires different permissions since a different API is used under-the-hood. Windows Azure Active Directory - Read directory data Microsoft Graph - Read all audit log data The Azure AD Application Registration needs to be in the Security Reader role for the subscription(s). ... View more

Your Azure AD application registration will need the following API permissions: Windows Azure Service Management API (Delegated) Access Azure Service Management as organization users Windows Azure Active Directory (Application) Read directory data (Delegated) Read directory data (Delegated) Sign in and read user profile The application will also need Reader access to your subscription(s). ... View more

The purpose behind the query window size and the delay throttle settings is to hedge against email message trace logs that do not come in sequentially.  For example, when the input runs, a start and end date are given to the MSFT API.  This would be the bounds for the query window.  The delay throttle is how close to “now” the end date can be.    When the input runs, the largest date seen from the query is saved to use as the start date for the next run.  For example:   The input runs and says "give me everything between 1:00 PM and 2:00 PM".  The API gives us the information and only has data up to 1:30 PM.  No problem – we save 1:30 PM to use next time. The input runs again and says "give me everything between 1:30 PM and 2:30 PM".  The API gives the information and we continue this cycle.   Here’s the "gotcha" though - Microsoft may delay message trace logs up to 24 hours.  During this delay, message traces may come out of sequence.  Continuing our example above, a message trace log with a time stamp of 1:29 PM may have come in delayed.  If we are already requesting data from 1:30 PM to 2:30 PM, we willl miss this delayed event.  The delay throttle makes sure we don’t go too fast and potentially miss events.   Here's a graphic to try to visualize this: ... View more

The Metrics input in the Azure Monitor Ad-on uses a REST API to get the metrics data rather than event hubs (the Activity input and the Diagnostic input do use event hubs though). There are 2 parts to the metrics input: Configure the input in Splunk (tenant ID, app ID/key, subscription ID, vault information). Tag the resource(s) you want with a "metrics" tag. The value of the tag should be the metric(s) you want to collect. More information here -> https://github.com/Microsoft/AzureMonitorAddonForSplunk/wiki/Configuration-of-Azure#metrics Here is a good reference on the metics available from Azure Monitor that can be ingested into Splunk -> https://docs.microsoft.com/en-us/azure/azure-monitor/platform/metrics-supported ... View more