Connecting Microsoft Azure Monitor to your DSP pipeline

When creating a data pipeline in Splunk Data Stream Processor (DSP), you can connect to Microsoft Azure Monitor and use it as a data source. Azure Monitor helps you understand how your applications are performing, and proactively identifies issues that affect your applications and the resources they depend on. You can get metrics data from Azure Monitor into a pipeline, transform the data as needed, and then send the transformed data out from the pipeline to a destination of your choosing.

To connect to Azure Monitor as a data source, you must complete the following tasks:

1. Create a connection that allows DSP to access your Azure Monitor data. See Create a DSP connection to Microsoft Azure Monitor.
2. Create a pipeline that starts with the Microsoft Azure Monitor source function. See the Building a pipeline chapter in the Use the manual for instructions on how to build a data pipeline.
3. Configure the Microsoft Azure Monitor source function to use your Azure Monitor connection. See Get data from Microsoft Azure Event Hubs in the Function Reference manual.

When you activate the pipeline, the source function starts collecting metrics from Azure Monitor. Each metric event is received into the pipeline as a record.

If your data fails to get into DSP, check the connection settings to make sure you have the correct tenant ID, client ID, and client secret for your Microsoft Azure Active Directory (AD) integration application. DSP doesn't run a check to see if you enter valid credentials.

How Microsoft Azure Monitor data is collected

The source function collects data according to the job schedule that you specified in the connection settings. See Scheduled data collection jobs for more information, including a list of the limitations that apply to all scheduled data collection jobs.

The following behavior from the Microsoft Azure Monitor connector might have an impact on the exact timing and scope of your data collection jobs:

• The connector collects metrics for the finest time-grain available in the Azure metric definition.
• The first time a scheduled job runs, the connector collects metrics for only one time interval. For all following scheduled jobs, the connector collects metrics from the last execution up to the current time, minus the number of minutes defined by the Delay parameter in the connection settings.