UserID in Microsoft 365 App for Splunk

[jgeorges]

I'm new to Splunk and the the Microsoft 365 App.   On many of the screens it will show logs and include only the raw "UserID" (eg. 7eaa8557-21cc-4242-baba-123456789abc) which makes visual identification difficult.

I just want to confirm that this is the expected behaviour, and is there an easy way to include the UserKey in addition/instead ?  Or is it a matter of setting up my own dashboards from a duplicate ?

Appreciate any thoughts.

J

[USAFA]

We have been seeing this lately as well.  Oddly the field "UserKey" will have the information that you are looking for.  I am not sure when or if the app will be updated.  

[jgeorges]

Thanks USAFA,

So it sounds like it is something that has changed recently ?  At least it isn't just my installation then I guess.

[moogmusic]

We're seeing this as well - looks like it changed on or around October 29th. Not sure whether to wait for an update in the Splunk Add-on for Microsoft Office 365 or just manually fix the Data Model?