Docs » Connect to your cloud service provider » Connect to Azure and send data to Splunk Observability Cloud » Send Azure logs to Splunk Log Observer

Send Azure logs to Splunk Log Observer 🔗

You can send logs from Azure to Splunk Log Observer by deploying a function that prepares and sends log data to the Splunk HTTP Event Collector (HEC) endpoint. To get started, follow these instructions.

Prerequisites 🔗

To send logs from Azure to Splunk Observability Cloud, you need the following:

Create an event hub in Azure 🔗

Azure uses diagnostic settings to send data to Event Hubs. Each resource you want to monitor must have a diagnostic setting. Follow these steps to configure an event hub for each use case:

  1. In Azure, go to Event Hubs and select Create.

  2. Select your Event Hub namespace.

  3. Set the name of the event hub to one of the following values depending on which logs you want to forward:

    Event Hub name: insights-activity-logs

    Note

    If you set a different hub name, update the function application settings to use the right name.

  4. Set the number of partitions. Use at least 4 partitions.

  5. Select Create.

Configure diagnostic settings to send logs 🔗

After you’ve created the event hub, follow these steps to activate diagnostic settings:

  1. In Azure, select the resource and go to Monitoring > Diagnostic settings.

  2. Create a new setting or edit an existing setting.

  3. Select the events you want to log.

  4. Select Stream to an event hub and select the event hub you’ve created.

  5. Select Save.

Set up the forwarding function in Azure 🔗

To deploy the Azure function, click the following button:

In the Function App Settings section, enter the following details:

Setting

Value

Event Hub Namespace

The namespace that contains the event hub you’ve created.

Splunk HEC Endpoint

https://ingest.<realm>.signalfx.com/v1/log where <realm> is your Observability Cloud realm. See Splunk HEC exporter for more information.

Splunk HEC Token

Your Observability Cloud ingest token. See Create and manage organization access tokens using Splunk Observability Cloud.

Note

Note about realms

A realm is a self-contained deployment of Splunk Observability Cloud in which your organization is hosted. Different realms have different API endpoints. For example, the endpoint for sending data in the us1 realm is https://ingest.us1.signalfx.com, while the endpoint for sending data in the eu0 realm is https://ingest.eu0.signalfx.com.

When you see a placeholder realm name in the documentation, such as <YOUR_REALM>, replace it with your actual realm name. To find your realm name, open the left navigation menu in Observability Cloud, select Settings, and select your username. The realm name appears in the Organizations section. If you don’t include the realm name when specifying an endpoint, Observability Cloud defaults to the us0 realm.

Security considerations 🔗

Azure encrypts settings by default. For increased security, you can transfer one or more of settings to a Key Vault. See the Key Vault documentation in the Azure docs for more information.

Additional resources 🔗

For examples and additional information, see https://github.com/splunk/azure-functions-splunk/tree/master/event-hubs-hec on GitHub.