Hi, we use the app Splunk Add-on for Microsoft Cloud Services version 5.3.1 on our HeavyForwarder. We ingest data from an eventhub which is splitted in a lot of eventhub names for different microsoft services (e.x. sharepoint, exchange etc.) The default sourcetype is "mscs:azure:eventhub" but the data isn't parsed with that. In some forums it was mentioned using the sourcetype "ms:o365:management". Someone had the same trouble finding the correct sourcetype? That app itself as a lot of config in props/transforms. Thanks   ... View more