topic Re: Office 365 logs in Splunk Enterprise

Office 365 logs

tmardan — Thu, 17 Sep 2020 18:05:24 GMT

Hello!

How can I add Office 365 logs to my Splunk if I have 1 search head and 2 indexers and using distributed search?

Should I install all add-ons on 1 indexer and make all configurations on it and all add-ons and app on search head?

thambisetty — Thu, 17 Sep 2020 19:11:35 GMT

I recommend HF.

Indexers are generally overloaded with requests coming from search head.

You can Install on Indexer if they are not overloaded.

tmardan — Thu, 17 Sep 2020 19:14:13 GMT

Thank you for answer!

You mean deploy heavy forwarder on another machine and configure it to receive logs from Office365 and then send them to my indexers?

thambisetty — Fri, 18 Sep 2020 08:03:39 GMT

exactly. To separate workloads to different worker machines.

tmardan — Fri, 18 Sep 2020 08:06:07 GMT

As I understood at this moment I can use for it universal forwarder too?

richgalloway — Fri, 18 Sep 2020 12:49:16 GMT

Start by reading the docs for the add-ons and apps you plan to install. They should say where they want to be installed.

In general, inputs should not be defined on indexers in a distributed environment. Doing so is likely to cause duplicated data. Put them on a heavy forwarder, instead. See https://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall

thambisetty — Mon, 21 Sep 2020 09:02:11 GMT

you can't use UF as it doesn't have python included in package.