topic problem with service status via Azure API in Getting Data In

problem with service status via Azure API

pedro_77 — Sun, 05 Jul 2020 19:23:10 GMT

Hello,

I'm trying to use Splunk Add-on for Microsoft Office 365 to collect service status from O365 Via azure API. I have configuration that each 5 minutes i'm asking about service status and i have noticed that for a few days in rows it works but afterwards Splunk receive events for certain sourcetype only once per day at 2am. The problem is only with sourcetype: o365:service:status. Another sourcetype form the same addon: sourcetype o365:management:activity works all the time without problem. Has anyone similar problem? There is some limitation here? or Azure API is unstable? addon version 2.0.2, Audit Log Search is enabled.

Re: problem with service status via Azure API

loderlukas — Wed, 09 Dec 2020 17:28:13 GMT

Hi Pedro,

I was just having the same issue. And I also found an article on the Microsoft page telling, that those logs are always 24h delayed. https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-service-communications-api-reference

They also say there, we need to use the messages to get new updates during the day. So I modified the search on the "Microsoft 365 App for Splunk" App. They are using at the moment this search to display the latest status:

index=azure `o365_service_status` | stats latest(FeatureStatus{}.FeatureServiceStatusDisplayName) AS Status by WorkloadDisplayName | rename WorkloadDisplayName AS Workload | sort - Status

If I update to this search, it works for me:

(index=azure (sourcetype="o365:service:status" OR (sourcetype="o365:service:message" FeatureDisplayName="*"))) | stats latest(Status) AS Status by WorkloadDisplayName | rename WorkloadDisplayName AS Workload | sort - Status

As you can see I had to use the other sourcetype, plust another field in the stats.

Hope that helps you too.

Re: problem with service status via Azure API

orca — Tue, 25 Jan 2022 19:47:04 GMT

Are you getting impacted by this? https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-service-communications-api-reference