All Apps and Add-ons

Microsoft Azure Template for Splunk App randomly stops ingesting data

Path Finder

I have been using this Add-on to collection signin and audit logs for Azure AD for a while now. However, there is a continue problem of randomly stop of data ingestion.

I couldn’t find any relevant error messages in the debug logs, and I had to re-enable the data inputs to fix it.

0 Karma

Splunk Employee
Splunk Employee

Are you using version 1.0.3 of the add-on? There were some improvements made to the data collection code in that release.

Also, Microsoft has exposed Azure AD sign-in and audit logs via Event Hubs now. The Azure Monitor Add-on for Splunk can ingest the Azure AD logs from an Event Hub -> https://splunkbase.splunk.com/app/3534/

0 Karma

Path Finder

Yes I am using version 1.0.3 Microsoft Azure Active Directory Reporting Add-on for Splunk

https://splunkbase.splunk.com/app/3757/

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!