@robayers  I've been messing around with this app for a few days and just got it working after seeing the same errors as you. You'll want to make sure your API permissions are set correctly and admin consent is granted in Azure then double check your configuration and input settings in the app. When adding the account under configuration in the app make sure you're using the Application (Client) ID found in the Overview section in Azure rather than the Client Secrets ID, this ended up being my issue. Also check that your traffic isn't getting blocked somewhere in your network. I found another thread where someone mentioned that was their issue. I can't find it again but they said something about their firewall not liking the endpoint input option set to worldwide and they were able to get it to work by setting that to USGovGCCHigh so that may be worth trying. ... View more

Well that CLI command didn't seem to find anything but creating a new lookup with just a single row with the user in question seems to work. I did try removing the lookup table and rebuilding it with fresh data which brought the size down to around 80mb from the several hundred it was before but I still have the same issue. ... View more

Thank you. This resolved the issue I was having too. ... View more

No need to pipe to subsearch: index=A sourcetype=srcTypeA Network_Address="1.1.1.1" NOT [search index=B "stringExample" | fields user] | stats values(src) AS srvIP values(time) AS time by user ... View more

Using mreynov's suggestion I piped the search in index A to a lookup table then used the following search to get my desired results |inputlookup lookUpName.csv | search NOT [search index=indexB "eventCode" | fields user] ... View more