Docs » Connect to your cloud service provider » Connect to Azure and send data to Splunk Observability Cloud » Send Azure logs to Splunk Log Observer

Send Azure logs to Splunk Log Observer ๐Ÿ”—

Caution

Splunk Log Observer is no longer available for new users. If you have a Log Observer entitlement, you must transition to Splunk Cloud Platform or Splunk Enterprise. Read more at Splunk Log Observer transition.

You can also use the Data Manager to send Azure logs to Splunk Platform. Learn how at Onboarding for Azure data in Data Manager .

You can send logs from Azure to Splunk Log Observer by deploying a function that prepares and sends log data to the Splunk HTTP Event Collector (HEC) endpoint. To get started, follow these instructions.

Prerequisites ๐Ÿ”—

To send logs from Azure to Splunk Observability Cloud, you need the following:

Create an event hub in Azure ๐Ÿ”—

Azure uses diagnostic settings to send data to Event Hubs. Each resource you want to monitor must have a diagnostic setting. Follow these steps to configure an event hub for each use case:

  1. In Azure, go to Event Hubs and select Create.

  2. Select your Event Hub namespace.

  3. Set the name of the event hub to one of the following values depending on which logs you want to forward:

    Event Hub name: insights-activity-logs

    Note

    If you set a different hub name, update the function application settings to use the right name.

  4. Set the number of partitions. Use at least 4 partitions.

  5. Select Create.

Configure diagnostic settings to send logs ๐Ÿ”—

After youโ€™ve created the event hub, follow these steps to activate diagnostic settings:

  1. In Azure, select the resource.

  2. Select Monitoring, then :guilabel:` Diagnostic settings`.

  3. Create a new setting or edit an existing setting.

  4. Select the events you want to log.

  5. Select Stream to an event hub and select the event hub youโ€™ve created.

  6. Select Save.

Set up the forwarding function in Azure ๐Ÿ”—

To deploy the Azure function, click the following button:

In the Function App Settings section, enter the following details:

Setting

Value

Event Hub Namespace

The namespace that contains the event hub youโ€™ve created.

Splunk HEC Endpoint

https://ingest.<realm>.signalfx.com/v1/log where <realm> is your Splunk Observability Cloud realm. See Splunk HEC exporter for more information.

Splunk HEC Token

Your Splunk Observability Cloud ingest token. See Create and manage organization access tokens using Splunk Observability Cloud.

Note

Note about realms

A realm is a self-contained deployment of Splunk Observability Cloud in which your organization is hosted. Different realms have different API endpoints. For example, the endpoint for sending data in the us1 realm is https://ingest.us1.signalfx.com, while the endpoint for sending data in the eu0 realm is https://ingest.eu0.signalfx.com.

When you see a placeholder realm name in the documentation, such as <YOUR_REALM>, replace it with your actual realm name. To find your realm name, open the navigation menu in Splunk Observability Cloud, select Settings, and select your username. The realm name appears in the Organizations section. If you donโ€™t include the realm name when specifying an endpoint, Splunk Observability Cloud defaults to the us0 realm.

Security considerations ๐Ÿ”—

Azure encrypts settings by default. For increased security, you can transfer one or more of settings to a Key Vault. See the Key Vault documentation in the Azure docs for more information.

Additional resources ๐Ÿ”—

For examples and additional information, see https://github.com/splunk/azure-functions-splunk/tree/master/event-hubs-hec on GitHub.