topic Extracting Office365 ModifiedProperties fields data into table in Splunk Search

Extracting Office365 ModifiedProperties fields data into table

spodda01da — Mon, 06 Sep 2021 14:10:33 GMT

Hello Team,

I not sure what I am missing but I am unable to extract or display ModifiedProperties{}.Name fields into table.

For example: Under extended fields of ModifiedProperties{}.Name there is another field "OtherMail". I would like to display OtherMail field value/data into a table

I remember doing sometime back but seems to have completely forgotten.

Can someone please help with it.

Thanks in advance,

Re: Extracting Office365 ModifiedProperties fields data into table

richgalloway — Mon, 06 Sep 2021 15:34:07 GMT

According to the screenshot, "OtherMail" is one of the values of ModifiedProperties{}.Name, not a field. Display it using the table command

| where ModifiedProperties{}.Name="OtherMail" | table ModifiedProperties{}.Name, ModifiedProperties{}.OldValue, ModifiedProperties{}.NewValue

Re: Extracting Office365 ModifiedProperties fields data into table

spodda01da — Tue, 07 Sep 2021 06:33:48 GMT

Thanks for replying, Unfortunately, the command is not working.