Having a difficult time to get this add-on to actually pull message trace logs from exchange online, and was wondering what role/access the actual account needs to be set at in the exchange admin console? Or maybe I'm just missing something entirely with the configuration of this add-on. Log messages from /opt/splunk/var/log/splunk/ta_ms_o365_reporting_ms_o365_message_trace.log show successful connections & get requests:
DEBUG pid=31238 tid=MainThread file=connectionpool.py:_new_conn:809 | Starting new HTTPS connection (1): reports.office365.com
DEBUG pid=31238 tid=MainThread file=connectionpool.py:_make_request:400 | https://reports.office365.com:443 "GET /ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2020-03-11T22:36:43.072002Z'%20and%20EndDate%20eq%20datetime'2020-03-11T23:36:43.072002Z' HTTP/1.1" 200 None
DEBUG pid=31238 tid=MainThread file=base_modinput.py:log_debug:286 | Next URL is https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2020-03-11T22%3A36%3A43.072002Z'%20and%20EndDate%20eq%20datetime'2020-03-11T23%3A36%3A43.072002Z'&$skiptoken=1999
DEBUG pid=31238 tid=MainThread file=base_modinput.py:log_debug:286 | Endpoint URL: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2020-03-11T22%3A36%3A43.072002Z'%20and%20EndDate%20eq%20datetime'2020-03-11T23%3A36%3A43.072002Z'&$skiptoken=1999
INFO pid=31238 tid=MainThread file=setup_util.py:log_info:114 | Proxy is not enabled!
