https://community.splunk.com/t5/Getting-Data-In/Microsoft-Azure-Add-on-for-Splunk-Almost-a-30-day-delay/m-p/583884#M102821 <P>Hi did you end up resolving this, my TA (on Splunk Cloud IDM) has fallen behind by a few days and seems to not be catching up.</P><P>Config:</P><P>Interval 600</P><P>Query Limit (optional) 0</P><P>Query Backoff Throttle 420</P> Mon, 07 Feb 2022 00:32:57 GMT J-Darlo 2022-02-07T00:32:57Z https://community.splunk.com/t5/Getting-Data-In/Microsoft-Azure-Add-on-for-Splunk-Almost-a-30-day-delay/m-p/553957#M91823 <P>The Azure Add on seems to be working well with the exception of how behind it is. Specifically for the signins (sourcetype&nbsp;<SPAN>azure:aad:signin).&nbsp;</SPAN>I can see in the add on logs on the heavy forwarder, that it is pulling in data, but the most recent event is May 4th as of now.&nbsp; So it appears as though it's pulling in data as of 30 days ago, but it's just very slowly making headway.&nbsp;</P><P>My input for the sign ins is set to a 900 second interval (I messed around with this a little bit but didn't really seem to help). The Query limit is set to 0 and the query backoff throttle is set to 5. Any suggestions on how to speed this up?</P> Tue, 01 Jun 2021 19:48:15 GMT https://community.splunk.com/t5/Getting-Data-In/Microsoft-Azure-Add-on-for-Splunk-Almost-a-30-day-delay/m-p/553957#M91823 rpoiri101 2021-06-01T19:48:15Z https://community.splunk.com/t5/Getting-Data-In/Microsoft-Azure-Add-on-for-Splunk-Almost-a-30-day-delay/m-p/583884#M102821 <P>Hi did you end up resolving this, my TA (on Splunk Cloud IDM) has fallen behind by a few days and seems to not be catching up.</P><P>Config:</P><P>Interval 600</P><P>Query Limit (optional) 0</P><P>Query Backoff Throttle 420</P> Mon, 07 Feb 2022 00:32:57 GMT https://community.splunk.com/t5/Getting-Data-In/Microsoft-Azure-Add-on-for-Splunk-Almost-a-30-day-delay/m-p/583884#M102821 J-Darlo 2022-02-07T00:32:57Z