Awesome that seemed to do it, thank you so much. index="azure-activity" | spath input=_raw path=properties.targetResources{}.modifiedProperties{} output=hold | eval hold = mvfilter(like(hold,"%Group.DisplayName%")) | spath input=hold path=newValue output=NewGroupName | search operationName="Add member to group" | stats count by "properties.initiatedBy.user.userPrincipalName", "properties.targetResources{}.userPrincipalName", NewGroupName, operationName, _time ... View more

Curious, did you ever find a fix for this? ... View more

If everything else works OK (other logs are ingested properly), it seems to be a local permissions problem. You can try to check the _internal events from this forwarder but I don't remember if the eventlog access problems show up in the logs if you don't raise debugging levels. ... View more

What do you mean by the Indexer tier? Where would that be located in the file structure on a Windows syslog server? ... View more