Azure AD log missing

cmtse · ‎06-27-2018

Hi there,

I had followed the installation instructions to install and configure Microsoft Azure Active Directory Reporting Add-on for Splunk on Heavy Forwarder. The sign-in activities log can be collected from Azure AD.

However, about 90% logs are missing while comparing with Azure portal. Does anyone has an idea about it?
Thanks in advance.

Cheers,
Ray

jconger · ‎08-09-2018

Are you using version 1.0.3? That version has some data collection improvements. Also Azure AD logs can be sent to Event Hubs now. The Azure Monitor Add-on for Splunk can be used to collect them from an Event Hub.

raoul · ‎07-27-2018

Perhaps a duplicate of my question

Azure AD log missing

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26

Make Your Machine Data AI-Ready in Splunk

Splunk Asynchronous Forwarding Explained

Join the Conversation

Azure AD log missing

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26

Make Your Machine Data AI-Ready in Splunk

Splunk Asynchronous Forwarding Explained