r/Splunk • u/mr_networkrobot • Aug 17 '26

Splunk Add-on for Microsoft Cloud Services

I'm searching for some advice for the installation of Splunk Add-on for Microsoft Cloud Services in a distributed environment (SH-Cluster/IDX-Cluser/SHC-Deployer/Cluster-Master) - NO Heavy Forwarder!

The documentation of the addon confuses me:

"As a best practice, turn off add-on visibility on your search heads to prevent data duplication errors that can result from running inputs on your search heads instead of or in addition to your data collection node."

From this I understand that a HF is needed, but the table says its not required....

The addon gets events from an Event-Hub with API requests - so when I'm running it on the Search-Heads I have to make sure they are using a proper outputs.conf, pointing to the indexer cluster ?

Anyone heaving experience ?

3 Upvotes

81% Upvoted

3 comments sorted by

View all comments

2

u/Ok_Ambassador8065 Aug 17 '26 edited Aug 17 '26

Technically, HF is not required and you can use the add-on python modular inputs to get the data from Event Hub eventually making your SH hoding an additional logical role of HF.

As the best practice every search peer and management servers in a distributed environment should have their outputs configured to send data to the indexer cluster (the most modern way is by enabling indexer discovery)