Splunk HEC to Azure Monitor

Question

Hi legends,

I am working with a SaaS based product that has OOTB integration with Splunk HEC. However, the company I work for does not use Splunk, it uses Azure Monitor and App Insights. Is there a way to redirect Splunk HEC requests from the source to Azure Monitor?

thanks,

abk

Answer 1

Please understand the pre-requisite before you do that:

1. Understand your current usage
2. Set up a Log Analytics workspace
3. Migrate Splunk artifacts to Azure Monitor
4. Collect data
5. Transition to Azure Monitor Logs

Well detailed i cant explain right here, but you can get someone to help with that.

Answer 2

Hi there, It's way easier to just install Azure Monitor Agent to the collector and send the required telemetry (I assume security logs) from the collector to Azure Monitor directly. Yes, Azure Monitor allows you to collect telemetry by API, but at the end the solution will look overcomplicated.