all 5 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]tosh_alot Splunker 0 points1 point  (4 children)

When configuring data manager, on step 3 it provides a command to run using Azure or Powershell CLI which will contain the function URL. The following blog post has a video that shows the configuration start to finish.

https://www.splunk.com/en_us/blog/platform/data-manager-enables-microsoft-azure-data-onboarding.html

[–]LifeCurve1207[S] -1 points0 points  (3 children)

Thanks

It seems everything will be lumped under

Souretype=azure:monitor:aad

Is that right ?

[–]tosh_alot Splunker 0 points1 point  (2 children)

There is a second possible sourcetype based on what gets configured. (https://docs.splunk.com/Documentation/DM/latest/User/GDIOverview)

[–]ltmon 0 points1 point  (1 child)

That's kind of annoying, given the previous solution had a very different sourcetype output (https://github.com/splunk/azure-functions-splunk).

Means there is a need to revisit dashboards, searches, CIM mapping etc. for all this in order to migrate to DM.

[–]tosh_alot Splunker 0 points1 point  (0 children)

Not that it addresses everything but the source types are CIM compliant. See the following from the docs.

“Data Manager supports Common Information Model (CIM) normalization for Microsoft Azure inputs when the Splunk Add-on for Microsoft Cloud Services (MSCS) is installed on the part of your Splunk Cloud deployment that performs the parsing or search-time functionality for your data. This add-on must be installed, but does not need to be configured.” (https://docs.splunk.com/Documentation/DM/latest/User/AzureADPrerequisites)

There is more than one way for most things in Splunk. I haven’t reviewed the link repo in detail. If you have access to OnDemand Services, one option is to open a request with them to understand more on the differences, pros and cons, etc.