Sending Data to Splunk

Overview

In this topic you can learn how to use the insights real-time data export feature to send data to Splunk and use it there.

Prerequisites

Note: Configure real-time data export before configuring Splunk reporting.

• Splunk Enterprise version 9.0.0 and higher.
• Splunk Enterprise deployed inside a Docker container (documentation version 9.0.0).
• Splunk Add-on for Microsoft Cloud Service to consume data through Event Hubs.

Configure Splunk integration with Event Hubs

Configure Splunk Add-on for Microsoft Cloud Services integration with Azure Event Hub.

The following table lists the components used for consuming Event Hubs data.

Component	Description
Inputs	A reader from a data source (e.g., EventHub added by the Microsoft Data Services add-on.
Indexes	Storage of data from the inputs that can be queried.
Search and Reporting	Data exploration from ad-hoc queries to persistent dashboards

Create event Index

You need to create an event index to integrate with Event Hubs.

Define a new index in Splunk

Note: Consider using default values unless you want specific index settings.

Set up Azure connection

To authenticate Splunk with Azure, you need to create an Azure AD application and a service principal.

1. Sign in to portal.azure.com.
2. Register an application with Azure AD and create a service principal.

3. Connect to Splunk Add-on for Microsoft Cloud Services using the Client ID / Tenant ID (Directory (tenant) ID in Azure). Alternatively, you can use Client secret.

   
   

   

   
   

Add data through Splunk Web

Define input and ingest data into the index.

Add data input using Splunk Web and configure the following settings:

• The Azure Event Hub Namespace (FQDN)
• The Azure Event Hub Name

• The Azure Event Hub Consume Group

  Note: Use More options to set the preferred index defined in Create event index.
  
  

  

  
  

Explore data

To explore the dataset you can start sampling available data.

Refine the data by filtering and grouping (e.g., see recent count of events for jobs).