I'm new to Splunk and the the Microsoft 365 App. On many of the screens it will show logs and include only the raw "UserID" (eg. 7eaa8557-21cc-4242-baba-123456789abc) which makes visual identification difficult.
I just want to confirm that this is the expected behaviour, and is there an easy way to include the UserKey in addition/instead ? Or is it a matter of setting up my own dashboards from a duplicate ?
Appreciate any thoughts.
We have been seeing this lately as well. Oddly the field "UserKey" will have the information that you are looking for. I am not sure when or if the app will be updated.
So it sounds like it is something that has changed recently ? At least it isn't just my installation then I guess.
We're seeing this as well - looks like it changed on or around October 29th. Not sure whether to wait for an update in the Splunk Add-on for Microsoft Office 365 or just manually fix the Data Model?