Getting Data In

Best way to index Microsoft Azure logs?

kiran331
Builder

Hi

What is the best practice to ingest windows events logs from Azure servers? Do we have to install Splunk Forwarder on Azure servers Or Any other way to get these logs to on-prem splunk?

0 Karma

larmesto
Path Finder

This might be helpful for anyone visiting; I have started working on an addon for Azure Event Hubs for Splunk, feel free to use it!
https://splunkbase.splunk.com/app/4343/

regards,

0 Karma

jconger
Splunk Employee
Splunk Employee

You can use a Universal Forwarder on the VM. But, you can also use the Splunk Add-on for Microsoft Cloud Services. This option does not require a UF installed on the VM. Instead, you configure which logs you want to collect in the Azure Portal and a storage account to write the logs. Then, use the Splunk Add-on for Microsoft Cloud Services to pick up these logs from the storage account and ingest them into Splunk.

0 Karma

kiran331
Builder

Thanks Jason, we ended up ingesting logs using Storage table, but the logs coming are Not CIM compatible and are not extracted, is there a add-on Or any plan to support for this one?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...