Ok, the results are in and on this basis I can see that the Azure AD Reporting Add-on is missing events. I set up an alternate ingest pipeline: AAD --> Event Hub --> Azure function --> Splunk HEC That reliably produces more events than the reporting add-on. ... View more

Thanks for the suggestion, will try this out. Have set up the event hub and can see activity. Will be interesting to do a side-by-side and see if I get a more complete set of events via this route than the API-based reporting add-on. ... View more

Completely agree with your statement: the latencies in the Microsoft reporting infrastructure causing lots of confusion/issues on how we can properly schedule our data ingestion without incomplete/duplicate data problem ... View more

Thanks. That did work. ... View more

Perhaps a duplicate of my question ... View more

Thanks, will try that. Initially I did not think it did the sign-ins, but on closer reading it may do. ... View more

Ok, so there is some relationship between the frequency of polling and how many events get ingested. The more frequent the polling the fewer events (the more missing events). The less frequent the polling the more events get ingested for any given period. I changed the polling from 300s to 600s and the number of events per minute went up by a factor of 3. ... View more

Changed the polling frequency to 600s to see if that makes a difference. ... View more

Some further details: Splunk Enterprise 7.0.2 Set the AAD Reporting add-on to retrieve every 300s After 24 hours of running am still only getting a subset of the audit records Can discern no pattern to the missing events; no obvious time boundary issue, no attribute of the events not present in splunk that stands out Needless to say this is a deal-breaker. If the audit in Splunk is not complete it is all but useless. Not sure how to progress in diagnosing this. ... View more

Thanks, I see the following in the logs: 15/05/2018 14:25:47.912 ***aborting after fassert() failure host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod 15/05/2018 14:25:47.912 2018-05-15T14:25:47.912Z I - host = splunk.liquidtelecom.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod 15/05/2018 14:25:47.912 2018-05-15T14:25:47.912Z I - Fatal Assertion 28652 host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod 15/05/2018 14:25:47.912 2018-05-15T14:25:47.912Z F NETWORK The provided SSL certificate is expired or not yet valid. host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod 15/05/2018 14:25:47.902 2018-05-15T14:25:47.902Z W CONTROL No SSL certificate validation can be performed since no CA file has been provided; please specify an sslCAFile parameter host = splunk.example.com source = /opt/splunk/var/log/splunk/mongod.log sourcetype = mongod ... View more

We have done a similar thing using the Splunk transaction command. You have a base search that returns the "removed" as a a startswith and the "installed" as an endswith option on the transaction command. Then set a maxspan=5m and then finally filter on results where the eventcount field that is added != 2. ... View more

What you need is to use eval and then the mvjoin() function. yoursearchhere | stats values(myField) as myFieldValues by field2 | eval myFieldValues=mvjoin(myFieldValues, ", ") ... View more

I downvoted this post because doesn't work ... View more

Actually, this just doesn't work. At any rate when I run such a query I do NOT get the values separated by commas. Nor would one expect it to based on the documentation of the makemv command which says: Converts a single valued field into a multivalue field by splitting it on a simple string delimiter. ... View more

This works, but why? Why does Splunk require three? By my logic I am escaping a backslash - one other backslash should do the trick... ... View more