All Apps and Add-ons

Are there plans for Splunk to support Splunk Support for Azure Monitor Add-On?

scottpazelt
Engager

This add-on is currently 'Community Supported'. Are there plans for Splunk to support this? If so, when will this be officially supported?

Thanks.

marycordova
SplunkTrust
SplunkTrust

I think Splunk/MS have not yet sorted out their logging...but I built a method that is better! 😄

https://answers.splunk.com/answers/678660/how-to-get-logs-from-azure-and-o365-into-splunk.html

@marycordova
0 Karma

marycordova
SplunkTrust
SplunkTrust

I attended the 2017 .conf presentation by John Kemnetz and Greg Oliver of Microsoft: http://conf.splunk.com/files/2017/recordings/monitor-and-manage-your-cloud-environment-with-azure-mo...

At .conf I was told by representatives of both Splunk and Microsoft that Microsoft is 100% committed to integration with Splunk and that there is a roadmap to merge the two apps in SplunkBase for into a single holistic supported integration.

This app seems to have a better approach (in my opinion) to logging and I am attempting to demo it now but I've encountered some issues with the installation and am not able to find support for those issues (hence my ending up here). Perhaps if the 30 or so people who have viewed this topic make some noise we will get that support.

The issue with the current Splunk built and supported app is that Splunk cannot provide any specific information as to precisely what their app is built to ingest (the answer is everything currently available in the API...) and thus there is no way to validate that the app is performing as expected.

On numerous occasions, logging in to the Azure portal and browsing audit logs produces evidence of activities which cannot be similarly located in the logs ingested into Splunk. This is a similarly dis-satisfying level of support even for a "supported" app.

@Splunk - what is the roadmap for seriously addressing logging for Microsoft Cloud (O365 and Azure) and what level of support will be provided?

@marycordova
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...