The Microsoft Azure App Template for Splunk has a dashboard called Portal Notification Overview which should show the Service Health events from the Activity Logs
Which input collects this data? We have Service Health events in the logs, but they are not showing up in splunk. Other events from that log are showing up.
`azure-audit` (subscription_id="*") eventSource.value=ServiceHealth
| stats latest(_time) AS l latest(status.value) AS Status values(eventName.value) AS Event values(properties.Region) AS Region values(properties.Service) AS Service by properties.IncidentId
| rename properties.IncidentId AS IncidentId
| eval "Last Activity"=strftime(l, "%Y-%m-%d %H:%M:%S %z")
| table IncidentId "Last Activity" Status Service Event Region
Even running this search, i only return Administrative, Alert, Policy, and Recommendation (very few, not all)
index=cloud_microsoft sourcetype="mscs:azure:audit"
| spath "operationName.localizedValue" output=OperationName
| stats count by eventSource.value