Azure Active Directory Stops

[jaxjohnny2000]

I updated the inputs.conf with additional threads (8) and start by shell = false. The data only seems to come in once we restart splunk after that, nothing.

sourcetype="o365:management:activity" Workload=AzureActiveDirectory

What else can I check to see if this is setup correctly?

[hok2010]

im facing the same problem, no NSG changes was done in any recent.

only problem is workload "azureactivedirectory" is not reporting and rest  workloads are pulling results perfectly fine.

[jaxjohnny2000]

My apologies for not updating this. We found the issue was the firewall/nsg in azure was changed.

[jsalsbur]

Are you still having an issue with this stopping? Did you find a resolution? I ask because I seem to be having the same issue.

[jaxjohnny2000]

here is out inputs.conf from /opt/splunk/etc/apps/splunk_ta_o365/local

[splunk_ta_o365_management_activity://management_activity_audit_azure_ad]
content_type = Audit.AzureActiveDirectory
index = cloud_azure
interval = 60
tenant_name = splunk_o365_tenant
start_by_shell = false
number_of_threads = 8

[splunk_ta_o365_management_activity://management_activity_audit_general_input]
content_type = Audit.General
index = cloud_azure
interval = 60
tenant_name = splunk_o365_tenant
start_by_shell = false
number_of_threads = 8