Exchange Online Logs in Splunk

ringo227 — Tue, 02 Dec 2025 16:03:12 GMT

Hi,

I would like to use Splunk to gather email metrics. For example, what email was send, to whom, whether it had an attachment, size of email and/or attachment. Seems like the O365 logs are pretty bad. E.g. The send activity doesn't even capture the recipient. Has anyone had any luck capturing this data? Appreciate any help you can provide.

Thanks,

Rich

Re: Exchange Online Logs in Splunk

VatsalJagani — Thu, 04 Dec 2025 17:32:22 GMT

@ringo227 - Only way currently available on Splunkbase to collect the email logs is with Office 365 Add-on.

https://splunk.github.io/splunk-add-on-for-microsoft-office-365/ConfigureMessageTraceInput/

https://splunkbase.splunk.com/app/4055

I hope this helps!!!

topic Exchange Online Logs in Splunk in Splunk Enterprise Security

Exchange Online Logs in Splunk

Re: Exchange Online Logs in Splunk