topic Re: Splunk to pull data from office 365 one drive in All Apps and Add-ons

Splunk to pull data from office 365 one drive

lmatilla — Thu, 16 Mar 2017 03:36:47 GMT

I have been figuring a way to pull data from Office 365 One Drive storage. The dump data that needs to be indexed are stored in one drive. I've installed the Microsoft Cloud Services add-on but need help in connecting. Am I in the right path? Thanks!

Re: Splunk to pull data from office 365 one drive

adonio — Sat, 13 May 2017 21:53:28 GMT

kindly read the documentation, very detailed step by step explanation. start here:
http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/About
installation:
http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Installationsteps
configuration start here and keeps on going for several pages:
http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/ConfigureappinAzureAD
hope it helps

Re: Splunk to pull data from office 365 one drive

jkat54 — Sat, 12 May 2018 11:51:22 GMT

I don’t think the ms cloud services app pulls from OneDrive. Looks like you’ll have to script your own input:

https://docs.microsoft.com/en-us/onedrive/developer/

Re: Splunk to pull data from office 365 one drive

jconger — Mon, 14 May 2018 20:55:55 GMT

The Splunk Add-on for Microsoft Cloud Services will pull activity data for OneDrive - things like file operations, user activity, file information, etc. The add-on does not index data that resides in OneDrive though. Can you dump the data to an Azure Storage account blob or file share? The add-on can index data from a blob or table. You could mount a file share to index data as well.

Re: Splunk to pull data from office 365 one drive

fahmed11 — Wed, 27 Mar 2019 20:47:08 GMT

Can you point me to documentation which shows that this add-on pulls OneDrive and other O365 application activity logs? So far it looks like O365 management api data, which doesn't contain user activity information.