Getting Data In

Microsoft Azure Add-on for Splunk - Almost a 30 day delay


The Azure Add on seems to be working well with the exception of how behind it is. Specifically for the signins (sourcetype azure:aad:signin). I can see in the add on logs on the heavy forwarder, that it is pulling in data, but the most recent event is May 4th as of now.  So it appears as though it's pulling in data as of 30 days ago, but it's just very slowly making headway. 

My input for the sign ins is set to a 900 second interval (I messed around with this a little bit but didn't really seem to help). The Query limit is set to 0 and the query backoff throttle is set to 5. Any suggestions on how to speed this up?

Labels (1)
Tags (1)
0 Karma


Hi did you end up resolving this, my TA (on Splunk Cloud IDM) has fallen behind by a few days and seems to not be catching up.


Interval 600

Query Limit (optional) 0

Query Backoff Throttle 420

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...