All Apps and Add-ons

O365 add-on - What is the new o365:graph:api used for? How to connect to O365 graph using add-on


Looking to see if we can ingest data from O365 that would list a person's name and what they accessed within Sharepoint. 

We were hoping that the new Graph API input from the O365 add-on would get us this information. 

Our O365 admin states that he needs to setup an app registration for us to access O365 Graph. Different than the Tenant ID and Client ID we are using to connect to O365 from the SPlunk add-on

He said - It would need to connect to Graph with the App ID and shared secret at a minimum

What endpoint is Splunk trying to pull from when it is using the Graph API Inputs?

O365 add-on documentation states: 


O365:graph:api              All Audit events and reports visable through the Microsoft Graph API endpoints. This

                                              includes all the logs events and reports visable thr the MS graphic API

Any help is appreciated. 
Labels (1)
0 Karma


Does anyone have any additional information about the Graph API input in the O365 add-on? 

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>