Hi Team,
We have 2 Heavy Forwarder servers in our environment (A & B) and in both the HF servers we have installed the Add-on "Splunk Add-on for Microsoft Cloud Services" and they were running with version 4.3.3
We have configured the inputs (totally 90+ inputs) which is fetching the data from Azure Storage Table and Blob and it was enabled (active) state in (A) HF server whereas in (B) server we have done all the configurations similar like (A) server but we have disabled the inputs. So logs would be getting ingested from this add-on only from (A) server.
So recently we have upgraded our Splunk Add-on for Microsoft Cloud Services from 4.3.3 to 5.1.0 in our HF server (B) server which is in disabled state.
So post upgrade in (B) server I have enabled all the 92 inputs to check the log flow from (B) HF server and later I have done a comparison with (A) and observed the behavior of the log flow in both server and came to know there is a difference.
i.e. When I search the data for last 60 minutes, with host from (B) (Add-on upgraded in this server to latest version) i can see around 221738 events whereas when I searched the data with (A) server for the same last 60 minutes i can see only 110531 events.
I don't know where is the gap and why there is a huge difference in it. So kindly help on how to check and get it fix the same.
