this removes null and uid from the target group. | search operationName="Add member to group" | stats count by "properties.initiatedBy.user.userPrincipalName", "properties.targetResources{}.userPrincipalName", "properties.targetResources{}.modifiedProperties{}.newValue", operationName, _time ``` removes uid ``` | regex properties.targetResources{}.modifiedProperties{}.newValue!=".{8}-.{4}-.{4}-.{4}-.{12}" ``` removes null value ``` | search NOT properties.targetResources{}.modifiedProperties{}.newValue="null" | rename "properties.initiatedBy.user.userPrincipalName" as initiated_user, "properties.targetResources{}.userPrincipalName" as target_user, "properties.targetResources{}.modifiedProperties{}.newValue" as group_name | eval group = replace(group_name, "\"", "") | eval initiated_user = lower(initiated_user), target_user = lower(target_user) ... View more

the solution is here: https://docs.splunk.com/Documentation/Splunk/9.0.1/Knowledge/Addfieldmatchingrulestoyourlookupconfiguration ... View more

thanks for sharing this.  I updated the permissions and it seem to work.  I'm still getting the same error in the  "splunk_ta_microsoft_cloudservices_mscs_[azure_event_hub_azure-west-activity-logs.log]" message="Blob checkpoint store not configured" However, Azure Event Hub events are in the indexer and searchable. ... View more