You may notice in a multi-tenant AXA environment that the format of the tenant can change, also that there is a difference between the tenant value for login and the tenant value used in snippets for app monitoring or for log monitoring.
 

What format should I use for the tenant to configure Log Analytics?

AXA 17.3

While ingesting data into Jarvis for any Log Analytics/AXA tenant, the tenant ID (also called as cohort ID) value is used and is stored in @tenant_id field in Jarvis/Elasticsearch.

The tenant ID field can be of UUID (hex string) format or can be of the format <tenant-name>-USERSTORE depending on how the tenant is created.

• If the tenant is created during installation, it uses an internal API which creates the tenant ID in the <tenant-name>-USERSTORE format.
• If the tenant is created using the adminUI it will have the ID value in hex UUID format.

So only for the default tenant created during installation, the ID will be in the format <tenant-name>-USERSTORE and for all other tenants created later through AdminUI it will be in the UUID format.

Also any new tenant created should automatically be added to the kafka topic logAnalyticsTenants

If you aren't sure of the tenant format, it is always wise to create a dummy app in AXA and check the web app option where a snippet will show the tenant value in the data-tenantId parameter, for example

 

Link to documentation about configuring UIM probes, which has more detail on checking the tenant ID value

https://comm.support.ca.com/kb/how-to-configure-the-log-analytics-probes/kb000010696