Does anyone provide me some information on doing a lift and shift from on-prem into Azure? Some services will still be on-prem and some would be in Azure. Would we just match our current On-Prem Splunk Requirements to Azure resources?  What are some best practices for forwarding data from a hybrid environment? Could we send everything to Azure Monitor and then forward it to Splunk and using index and search head clusters.   The Splunk architecture is using Linux. We have some heavy and universal forwarders sending out data to Splunk.  Thank you!     ... View more