About monicapandrakul

monicapandrakul · ‎07-20-2020

[LA://Source_AzureActivity] application_id = ################# application_key = *********** event_delay_lag_time = 15 index = myazureactivity_index sourcetype = myazureactivity_sourcetype interval = 300 log_analytics_query = AzureActivity | where ResourceGroup != "" resource_group = TTTTTTTTTTT start_date = 01/01/2019 00:00:00 subscription_id = ########################### tenant_id = ********************************** workspace_id = ################################### disabled = 0 we have similar configuration for rest of the inputs, but i am seeing less coung only for azure activity

monicapandrakul · ‎07-20-2020

@jkat54

monicapandrakul · ‎07-20-2020

I have installed TA-ms-loganalytics on my heavy forwarder and from this add-on i am getting various logs from my azure workspace into splunk. Now i am facing a problem where the event count in splunk varies from what i have in my azure LA worspace. this is for Activity Logs. On Azure LA worspace Activity Logs count : 90+ On Splunk Activity Logs count : 6-8 only is it the add on is breaking at some point? or any blocker in azure end? Kindly help.

Posts	3
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-19-2020

Online Status	Offline
Date Last Visited	‎07-20-2020 04:58 AM

TA-ms-loganalytics add-on on heavy forwarder

Re: TA-ms-loganalytics add-on on heavy forwarder

Re: TA-ms-loganalytics add-on on heavy forwarder

TA-ms-loganalytics add-on on heavy forwarder

Join the Conversation

TA-ms-loganalytics add-on on heavy forwarder

Re: TA-ms-loganalytics add-on on heavy forwarder

Re: TA-ms-loganalytics add-on on heavy forwarder

TA-ms-loganalytics add-on on heavy forwarder