Azure prerequisites for Data Manager

Ask your Azure admin to complete prerequisites ahead of time so that your Splunk Cloud administrator can use Data Manager for onboarding. Alternatively, your Azure admin can complete the entire process. Data Manager contains optional steps to guide you through this choice.

Common Information Model prerequisites

Data Manager supports Common Information Model (CIM) normalization for Microsoft Azure inputs when the Splunk Add-on for Microsoft Cloud Services (MSCS) is installed on the part of your Splunk Cloud deployment that performs the parsing or search-time functionality for your data. This add-on must be installed, but does not need to be configured.

Download the Splunk Add-on for Microsoft Cloud Services (MSCS) from Splunkbase.

For more information, see the Splunk Add-on for Microsoft Cloud Services documentation manual.

For information on the CIM, see the Overview of the Splunk Common Information Model topic in the Common Information Model Add-on manual.

Azure data source prerequisites

Azure prerequisites

You need a Microsoft Azure account with administrator permissions to prepare the prerequisites for Data Manager.

To register your app in the Azure portal, you need a subscription to Azure. Make a note of your Client Secret. If you lose your Client Secret, you have to generate a new one.

In Data Manager, you will use the API permissions that were added by default when you registered your app in the Azure Portal.

Role prerequisites

The onboarding user must have the Owner role for the Azure subscription where the ARM template will be deployed, in order to create the data ingestion resources. If you do not have the subscription Owner role and would like to perform the onboarding yourself, ask the subscription Owner to assign you the subscription Owner role. For more information, see the Assign a user as an administrator of an Azure subscription topic in the Microsoft Azure documentation.

Data tags prerequisites

There are two default tags, present on all the Azure resources, that are always shown on the modal:

• SplunkDMInputId
• SplunkDMDeletionOrder

Out of these tags, the value of SplunkDMInputId will be same on all the resources that were created per each Azure data input, but the value of SplunkDMDeletionOrder changes, depending on each resource, since it is the order in which the resources will be deleted if the user wants to delete the input.