MessageTrace sourcetype is incomplete

[JScordo]

I had sent and received 5 total test emails yesterday. Only two of those emails showed up int he logs and we confirmed from the office365 side of things that all 5 of those emails were received and verified delivered.

Is there a way to further test the app to make sure all logs are complete and all messages are being logged to sourcetype="ms:o365:reporting:messagetrace" ? Is there any further documentation that i'm missing for troubleshooting purposes.

I opened a support ticket requesting help but they stated that since this was a community app they couldn't help and closed out the case.

[jconger]

According to Microsoft, events can be delayed up to 24 hours -> https://msdn.microsoft.com/en-us/library/office/jj984335.aspx#Data%20granularity,%20persistence,%20a... So, it could be a delay in data availability from Microsoft. Or, it could be an error as well. Try the following search to see if there are any errors reporting back:

index=_internal sourcetype=*ms_o365_message_trace*