Linux Syslog → Microsoft Sentinel

Select a component for configuration, or a connection for full relationship details. Arrowheads show data flow direction.

Azure Storage + CCF bridge

Event data Notifications Failures Relationship labels

Event walkthrough

Sample event Synthetic example · illustrative export schema

This walkthrough uses a deliberately normalized JSON envelope. Your pipeline and DCR must match the actual exported fields, JSON framing and compression.

Customer environment Sources & collection

1 · Sources

2 · Collection

Splunk Cloud Splunk-hosted processing

3 · Splunk Cloud

Microsoft Azure Customer Azure subscription / tenant

4 · Azure storage & notifications

5 · Microsoft Sentinel

Select a component

Inspect its required configuration and connections.

Environment values

Notional names for every value the configuration guide asks you to set. They follow one naming convention (organisation contoso, region australiaeast) and match environment.example.sh. Replace them with your own; IDs are placeholders, and secrets are never written here.

Area	Setting	Notional value	Variable / placeholder	Used in

Full configuration guide

End-to-end setup examples for the custom-table path. Replace environment values and verify the actual exported JSON schema before deployment.

All relationships and protocols

All required configurations

Deployment notes and prerequisites

Source protocols: UDP/TCP 514 or TLS TCP 6514. SC4S uses HEC; Universal Forwarder uses S2S. rsyslog/syslog-ng can write files for forwarder collection.
Requires Splunk Cloud 10.4.2604 or higher and an Ingest Processor Azure destination.
Create a storage account with hierarchical namespace enabled, an export container, notification queue and dead-letter queue.
Configure the Splunk Azure connection using an Entra application with Storage Blob Data Contributor. Set the dataset to Pipeline output and JSON.
Route selected Linux syslog to the dataset. Configure a parallel Splunk indexing path if required.
Inspect one exported file before defining JSON paths, DCR input types and timestamp conversion.
Create the LinuxSyslog_CL table, DCE and DCR. Preserve the original message and timestamp.
Deploy and customize the managed Sentinel Azure Storage Blob CCF connector, including its reader identity and Blob/Queue permissions.
Configure Event Grid BlobCreated notifications for the export folder, pointing to the connector notification queue.
Generate a test event and verify the blob, notification consumption and destination table. Monitor failures and duplicates.

Logical architecture only. Connections are illustrative; this POC does not connect to cloud services or deploy resources.

Splunk Azure destinations · Sentinel Blob connector setup · CCF and DCR reference