Message Trace - Splunk Add-On for Microsoft Office 365

[shaunm001]

Hi, we've configured the "Message Trace" input type for Splunk Add-On for Microsoft Office 365 but don't seem to be receiving any data. Other input types (Mailbox, Management Activity, etc) are working. Not sure what the problem is, any suggestions on how to troubleshoot? 

I did notice a discrepancy when viewing the current configuration of the input versus the options available when editing the input (the same value is reported "in days" in one place and "in minutes" in another):

Could it be my delay throttle truly is set to 1440 days rather than minutes?

I believe I have all the API permissions set correctly, but let me know if this doesn't look right:

[Meett]

Hello @shaunm001 ,

Can you please check internal log specific to this input ? is there any ERROR logs present? 

[shaunm001]

Hello, I'm not exactly sure where to check the logs for this Add-On. Am I looking in Splunk or am I looking on the Azure side?

[Meett]

Hello @shaunm001 ,

You should first check internal logs in Splunk using Query such as,

index="_internal" *O365* *ERROR*

Based on ERROR logs we can troubleshoot this further.

[shaunm001]

There are no "ERROR" messages associated with the message trace input, but there are numerous "INFO" messages that seem to indicate data is being successfully brought in:

I just dont see anything that looks like a message trace entry when searching the index that I've configured for these logs.  Unless it's these "Exchange" records that show operations like "Send"," MailItemsAccessed" etc, but I feel like those are coming from a different input (e.g., the "Mailbox Usage Detail" input):

[Meett · Accepted solution]

@shaunm001 You can check the source-type along with index you are searching to it should’ve presence of MessageTrace, i can’t see much on your environment but if you still have confusion you can put down support case to get more help.

[shaunm001]

Ah, I do see it now, thanks. I was assuming all data would be included in one of the "Workload" (e.g. "Exchange") or "app" data values, but the sourcetype "o365:reporting:messagetrace" does not have "Workload" or "app" data values and I was excluding the message trace events with search parameters like "Workload="*""

Appreciate the help!