All Apps and Add-ons

How to get log from o365 on azure

sittipornbaycom
Observer

Hi

I would like to know step or document for integrate between splunk with o365 on azure, But it's want "Client Secret" from azure to insert into Splunk. Where can i get it ?

I try solution this URL:https://splunkbase.splunk.com/app/4055/ but it can't find any splunk URL for register on azure to get "Client Secret".

Thanks

Regards

0 Karma

dsoni_splunk
Splunk Employee
Splunk Employee

@sittipornbaycoms

Client Secret-key can be found over here:

Login to Azure platform >> Go to Azure Active Directory >> App Registartions >> Select your registered Application >> Select App >> Click on Settings >> Keys >> Generate Key

nickhills
Ultra Champion

Getting the o365/azure apps to work is a multi step process.

Once you have installed the Splunk add-in you need to configure an 'integration application' inside your Azure portal to allow your Splunk server to be authorized and authenticate.
https://docs.splunk.com/Documentation/AddOns/released/MSO365/ConfigureappinAzureAD

Then you have to configure your 365 tenant in Splunk with the relevant credentials from the step above.
https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configuretenant

When you have done both of those, you can configure your inputs to collect the required data.
https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configureinputs

If my comment helps, please give it a thumbs up!
0 Karma

sittipornbaycom
Observer

I try solution this but it can't connect with azure because it not have URL for splunk app register on azure to get "Client Secret".

0 Karma

nickhills
Ultra Champion

Have you done this?
(Step 1 from the first link)

https://docs.microsoft.com/en-us/office/office-365-management-api/get-started-with-office-365-manage...

If my comment helps, please give it a thumbs up!
0 Karma

sittipornbaycom
Observer

I try to follow Use the Azure Management Portal to register your application in Azure AD in "Get started with Office 365 Management APIs".
But I can not find the sign-on url and app id url in steps 7 Enter the appropriate App properties.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...