MSFT Azure AD Reporting Add-On for Splunk

All Apps and Add-ons

So we followed the instructions for the document to a T but when i do a search of the index, there's no data. We have an Azure AD Premium P1 and double checked the granted permissions and they're perfect.

https://splunkbase.splunk.com/app/3757/#/details
https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-configure-prerequis...

Any tips on what to look for in terms of troubleshooting this? Or this because we haven't installed the add-on for the heavy forwarder?

Thanks

Get Updates on the Splunk Community!

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...