Hi everyone, I'm trying to view the events from Azure AD MFA in Splunk Cloud.  Use the sign-ins report to review Azure AD Multi-Factor Authentication events - Azure Documentation https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-reporting We already have the Microsoft Office 365 App and Add-on in Splunk, but in the authentication logs we are not seeing anything related with MFA data. It is supposed to be in Splunk already? Am I missing something? Is there another way to collect that report into Splunk?  Thanks! ... View more

Hi, How can I send an empty schedule report (no events in the search)?  I need to send a schedule report (daily) from an alert but sometimes there are no results. They need to see that csv report even is empty, but the visualization won't appear if there are no results. Did you know how can I do that? Just the table visualization with empty results/values. The fillnull don't work for this or am I using it wrong?   Thanks! ... View more

Hi,  We are doing consults via API with the query:  index=_internal sourcetype=splunk_python subject |fields subject,recipients | where subject like "%ORION%"' But when we try to collect the results, give us an error from a lookup that is not part of the original search. Via web the search is working fine, but the problem is via API. Have you experienced something like that? Thanks! ... View more