Azure prerequisites for Data Manager

Ask your Azure admin to complete prerequisites ahead of time so that your Splunk Cloud administrator can use Data Manager for onboarding. Alternatively, your Azure admin can complete the entire process. Data Manager contains optional steps to guide you through this choice.

On December 3, 2022, Microsoft ended support for Azure function runtime versions 2.x and 3.x. Azure environments that contain function apps running on versions 2.x and 3.x of the Azure Functions runtime are no longer supported. Function apps can be created and deployed, and existing apps continue to run, but your apps won't be eligible for new features, security patches, performance optimizations, and support until you upgrade them to version 4.x.

End of support for these runtime versions is due to the ending of support for .NET Core 3.1, which is required by these older runtime versions. This requirement affects all Azure Functions runtime languages.

For more information, see the Migrate to Azure function runtime version 4.x section of the New Features topic in the Data Manager release notes.

Common Information Model prerequisites

The Common Information Model (CIM) is an open standard that enables normalizing data from different sources into a shared model. It is applied when you run a search to give you more insight. To ensure that Data Manager supports the CIM on Microsoft Azure inputs, you must install the Splunk Add-on for Microsoft Cloud Services (MSCS). Install the add-on on the part of your Splunk Cloud deployment that performs the parsing, field extraction, or search-time processing for your data. This add-on must be installed, but does not need to be configured.

Download the Splunk Add-on for Microsoft Cloud Services (MSCS) from Splunkbase.

For more information, see the Splunk Add-on for Microsoft Cloud Services documentation manual.

For information on the CIM, see the Overview of the Splunk Common Information Model topic in the Common Information Model Add-on manual.

Azure data source prerequisites

Azure prerequisites

• You need a Microsoft Azure account with administrator permissions to prepare the prerequisites for Data Manager.
• To register your app in the Azure portal, you need a subscription to Azure. Make a note of your Client Secret. If you lose your Client Secret, you have to generate a new one.
• In Data Manager, you will use the API permissions that were added by default when you registered your app in the Azure Portal.
• Verify Azure function app runtime 4.x support.
  
  On December 3, 2022, Microsoft ended support for Azure function runtime versions 2.x and 3.x. Azure environments that contain function apps running on versions 2.x and 3.x of the Azure Functions runtime are no longer supported. Function apps can be created and deployed, and existing apps continue to run, but your apps won't be eligible for new features, security patches, performance optimizations, and support until you upgrade them to version 4.x.
  
  For more information, see the Migrate to Azure function runtime version 4.x section of the New Features topic in the Data Manager release notes.

Role prerequisites

The onboarding user must have the Owner role for the Azure subscription where the ARM template will be deployed, in order to create the data ingestion resources. If you do not have the subscription Owner role and would like to perform the onboarding yourself, ask the subscription Owner to assign you the subscription Owner role. For more information, see the Assign a user as an administrator of an Azure subscription topic in the Microsoft Azure documentation.

Data tags prerequisites

There are two default tags, present on all the Azure resources, that are always shown on the modal:

• SplunkDMInputId
• SplunkDMDeletionOrder

Out of these tags, the value of SplunkDMInputId will be same on all the resources that were created per each Azure data input, but the value of SplunkDMDeletionOrder changes, depending on each resource, since it is the order in which the resources will be deleted if the user wants to delete the input.