Microsoft Azure Data Explorer Add-On for Splunk allows users to effortlessly ingest data from Splunk to Azure Data Explorer which is a fast and scalable data analytics platform designed for real-time analysis of large volumes of data.
The following kinds of data are most suitable for ingestion into Azure Data Explorer, but are not limited to the following list:
Ingesting Data from Splunk to Azure Data Explorer using Azure Data Explorer Addon
Details on pre-requisites, configuring the add-on and viewing the data in Azure Data Explorer is covered in this section.
When we add data to Splunk, the Splunk indexer processes it and stores it in a designated index (either, by default, in the main index or custom index). Searching in Splunk involves using the indexed data for the purpose of creating metrics, dashboards and alerts. This Splunk add-on triggers an action based on the alert in Splunk. We can use Alert actions to send data to Azure Data Explorer using the specified addon.
This add-on uses kusto python sdk (https://learn.microsoft.com/en-us/azure/data-explorer/kusto/api/python/kusto-python-client-library) to send log data to Microsoft Azure Data Explorer. Hence, this addon supports queued mode of ingestion by default. This addon has a durable feature as well which helps to minimize data loss during any unexpected network error scenarios. Although durability in ingestion comes at the cost of throughput, therefore it is advised to use this option judiciously.
After installation of the Splunk Addon for alerts, it should be visible in the Dashboard -> Alert Actions
5. Configure the Azure Data Explorer connection details such as application client Id, application client secret, cluster name, database name, table name.
6. When the alert is created, it should be visible in Splunk Dashboard -> Alerts
The following is the list of parameters which need to be entered/selected while configuring the addon:
Please refer to the following links for further details:
Link to Splunk Base Addon : Microsoft Azure Data Explorer Add-On for Splunk | Splunkbase
Link to Github Source code of Addon: azure-kusto-splunk/splunk-adx-alert-addon at main · Azure/azure-kusto-splunk (github.com)
In this blog post, we have seen how Microsoft Azure Data Explorer Add-On for Splunk can help us ingest data from Splunk to Azure Data Explorer, a powerful data analytics platform. We have also learned about the types of data that are most suitable for Azure Data Explorer, and how to configure the add-on and use alert actions to send data to Azure Data Explorer. By using this add-on, we can leverage the benefits of both Splunk and Azure Data Explorer, and gain deeper insights from our data.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.