https://community.splunk.com/t5/All-Apps-and-Add-ons/Microsoft-Office-365-App-for-Splunk/m-p/463442#M74121 <P>Hi nicktaitano,<BR /> the problem in in eventtypes and macros: there isn't the indication of Indexes.<BR /> You can test this anomaly opening the search of one panel in Search dashboard and adding the <CODE>index=your_index</CODE> filter to the main search.<BR /> You can solve this problem in two ways:</P> <UL> <LI>put the indexes in the default search path [ Settings -- Access Controls -- Roles -- -- Indexes];</LI> <LI>create an eventtype with <CODE>index=your_index</CODE> and put this eventtype in each eventtype or macro of your App.</LI> </UL> <P>I prefer the second though it requests more work, because it's more clear and more performant.</P> <P>Ciao.<BR /> Giuseppe</P> Sat, 19 Oct 2019 17:19:53 GMT gcusello 2019-10-19T17:19:53Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Microsoft-Office-365-App-for-Splunk/m-p/463441#M74120 <P>App Veresion: 2.0.2<BR /> Splunk 7.x</P> <P>Installed the Splunk App, configured the Azure/O365 accounts and I'm able to view data from services we're currently subscribed: OneDrive, Teams, Exchange but I'm not able to populate the 'Azure Active Directory' graph on the main app dashboard.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7838i9030683E9362361F/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>If I click on 'Azure AD' at the very top I'm able to view the Azure failed logons so I'm not sure why it's not populating the information on the main dashboard.</P> Fri, 18 Oct 2019 23:05:56 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Microsoft-Office-365-App-for-Splunk/m-p/463441#M74120 nicktaitano 2019-10-18T23:05:56Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Microsoft-Office-365-App-for-Splunk/m-p/463442#M74121 <P>Hi nicktaitano,<BR /> the problem in in eventtypes and macros: there isn't the indication of Indexes.<BR /> You can test this anomaly opening the search of one panel in Search dashboard and adding the <CODE>index=your_index</CODE> filter to the main search.<BR /> You can solve this problem in two ways:</P> <UL> <LI>put the indexes in the default search path [ Settings -- Access Controls -- Roles -- -- Indexes];</LI> <LI>create an eventtype with <CODE>index=your_index</CODE> and put this eventtype in each eventtype or macro of your App.</LI> </UL> <P>I prefer the second though it requests more work, because it's more clear and more performant.</P> <P>Ciao.<BR /> Giuseppe</P> Sat, 19 Oct 2019 17:19:53 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Microsoft-Office-365-App-for-Splunk/m-p/463442#M74121 gcusello 2019-10-19T17:19:53Z