Splunk Add-on for Microsoft Cloud Services - Service Health

[jaxjohnny2000]

The Microsoft Azure App Template for Splunk has a dashboard called Portal Notification Overview which should show the Service Health events from the Activity Logs

Which input collects this data?  We have Service Health events in the logs, but they are not showing up in splunk.  Other events from that log are showing up. 

`azure-audit` (subscription_id="*") eventSource.value=ServiceHealth
| stats latest(_time) AS l latest(status.value) AS Status values(eventName.value) AS Event values(properties.Region) AS Region values(properties.Service) AS Service by properties.IncidentId
| rename properties.IncidentId AS IncidentId
| eval "Last Activity"=strftime(l, "%Y-%m-%d %H:%M:%S %z")
| table IncidentId "Last Activity" Status Service Event Region

[jaxjohnny2000]

Even running this search, i only return Administrative, Alert, Policy, and Recommendation (very few, not all)

index=cloud_microsoft sourcetype="mscs:azure:audit"
| spath "operationName.localizedValue" output=OperationName
| stats count by eventSource.value