Azure AD log missing

cmtse · ‎06-27-2018

Hi there,

I had followed the installation instructions to install and configure Microsoft Azure Active Directory Reporting Add-on for Splunk on Heavy Forwarder. The sign-in activities log can be collected from Azure AD.

However, about 90% logs are missing while comparing with Azure portal. Does anyone has an idea about it?
Thanks in advance.

Cheers,
Ray

jconger · ‎08-09-2018

Are you using version 1.0.3? That version has some data collection improvements. Also Azure AD logs can be sent to Event Hubs now. The Azure Monitor Add-on for Splunk can be used to collect them from an Event Hub.

raoul · ‎07-27-2018

Perhaps a duplicate of my question

Azure AD log missing

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Index This | What travels the world but is also stuck in place?

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

Join the Conversation

Azure AD log missing

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Index This | What travels the world but is also stuck in place?

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...