topic Re: MS Teams meeting reports in Dashboards & Visualizations

MS Teams meeting reports

bjhenrick — Wed, 10 Dec 2025 15:18:28 GMT

I am new to using Splunk and I am running a report to list all Teams meetings that were recorded over the past 6 months. I am getting duplicate entries in my report because MSFT creates a TMP file when the recording starts.

The search parameters I am using to generate the report:

index=o365 Operation=FileModified SourceRelativeUrl= "*/Recordings" SourceFileExtension = "mp4"

The search results will present 2-3 ObjectId's for the same meeting and I am trying to figure out how I can omit the results that included ~tmp.

Any help that can be provided on the correct search parameters to not include these results would be appreciated...Thanks

Re: MS Teams meeting reports

PickleRick — Wed, 10 Dec 2025 15:56:18 GMT

Add

| where NOT searchmatch(SourceFile,"*/~tmp*")

(assuming your file's name is in a field called SourceFile; if it's not - adjust accordingly).

Re: MS Teams meeting reports

bjhenrick — Wed, 10 Dec 2025 16:43:15 GMT

Thanks but I am getting the following error.

Error in 'where' command: The arguments to the 'searchmatch' function are invalid.

Re: MS Teams meeting reports

PickleRick — Wed, 10 Dec 2025 19:59:13 GMT

Swap the arguments. I was writing from memory.