We are uploaded Microsoft Office 365 Reporting Add-on for splunk. We noticed splunk is unable to collect all the logs from EOP.
Outbound emails are 103 and splunk reports the outbound only 32. How do we address this gap.
More details.
Q. What is the deployment architecture of your Splunk? e.g. Search head clustering, indexing clustering, how many search heads instances or indexers instances.. etc.
Subbu: As this is a test environment,have only 1 search head
Q. Has this worked in the past? or Is that newly installed?
Subbu: This is newly installed and configured.
Q. When did you first notice this issue?
Subbu: After 24hrs from configuration.
Q. Have there been any recent changes to the application or the environment? (unique conditions, recent changes, updates, etc.)
Subbu: No changes
Q. What is the version of Splunk?
Subbu:6.6.3
Q. What is the version of the add-on that you have installed? Where is the add-on installed? (i.e. on HF or SH)
Subbu:1.1.0
Q. Are you facing issue with Microsoft Office 365 Reporting Add-on for Splunk?
Subbu:Yeah
Thanks,
Subbu
