topic Re: Azure Add-on user data truncation in Getting Data In

Azure Add-on user data truncation

drobMT — Mon, 12 Oct 2020 22:22:39 GMT

I'm using the Azure Add-on for splunk to pull in our azure AD signin, audit and user data; all is work well for the most part with the exception of some user events (sourcetype="azure:aad:user") seem to have truncated json and therefore don't parse correctly.

Is there a limit setting for this that can remediate this?

Re: Azure Add-on user data truncation

richgalloway — Tue, 13 Oct 2020 13:27:38 GMT

You should be able to change the truncation in the app's local/props.conf file.

[azure:aad:user] TRUNCATE = some big enough number

Re: Azure Add-on user data truncation

drobMT — Tue, 13 Oct 2020 16:06:57 GMT

I'll give that a shot and see what happens! Thanks!

Re: Azure Add-on user data truncation

drobMT — Tue, 13 Oct 2020 18:04:23 GMT

Thanks! I added a /local/props.conf with

[azure:aad:user] TRUNCATE = 20000

and that worked.

I found by default that it was truncating at 10000. So i guessed and used 20000; that seemed to work.

I then searched the most recent data pull for raw events that didn't match (looking for events without the closing "}" at the end of the JSON event).

index=azuread sourcetype="azure:aad:user" | regex _raw!="\}$"

When nothing matched I knew I was big enough. So I verified with

index=azuread sourcetype="azure:aad:user" | eval CharCount=len(_raw) | stats max(CharCount) as maxCharCount

and found my largest event (user profile) was just under 16000 characters, so 20k gives me some margin of error.

Thanks for your help!