There seems to no longer be any mention of event_format_flags in the latest app upgrade documentation as of the release of v4.5.1.  So maybe this is no longer necessary in the updated app. Upgrade the Splunk Add-on for Microsoft Cloud Services - Splunk Documentation ... View more

I think you would have to disable autoBatch or upgrade to 9.0.1 (not 9.0.0.1). ... View more

Is this still broken for everyone?  It's been 3 months for us.   I thought there was supposed to be a fix for 8.2.x.  Or is 9.x the only way to fix it? ... View more

For those who ugpraded to v9.x, this may be applicable: https://docs.splunk.com/Documentation/Forwarder/9.0.1/Forwarder/KnownIssues 2022-06-22SPL-226003 When forwarding from an 9.0 instance with useAck enabled, ingestion stops after some time with errors: "Invalid ACK received from indexer=" Workaround: As a workaround, disable useAck in outputs.conf on the forwarder. After disabling, indexers start to ingest data. If customers do need useACK to prevent data loss, disabling autoBatch in outputs.conf can remediate the issue too, but it impacts throughput - no worse than 8.x, but no improvement for 9.0.   ... View more

Turning off useAck is a compliance finding for anyone following STIG. Definitely not a fix, but at least it narrows the issue down for Splunk. ... View more