All Apps and Add-ons

Office 365 logs - ingest more than 7 days history

schanson
New Member

I'm using the Splunk Add-on for Microsoft Cloud Services to ingest logs from Office 365. Specifically, I'm getting the Exchange Online Audit and Azure AD Audit logs.

After the O365 Management API input was successfully created, 7 days of log history was pulled into Splunk and new logs are rolling in, which is a great start. However, I would like to pull in more historical data. I'm looking for at least 30 days, or better yet, the entirety of log data retention (e.g., up to 90 days). I don't see any configurable options in the app itself, and I poked around in the app's .conf files a bit, but didn't see anything that looked like an option to change the number of days to be ingested. I'm wondering if it may be hard-coded somewhere in the app's logic, where it could be updated to suit my needs.

0 Karma

dstefan
New Member
0 Karma

schanson
New Member

Thanks for the input, but I don't think that is the constraint. When I log into the web console or use Powershell to pull logs, there is retention going back for nearly a year.

Looks like the limitation is in the O365 Management API that the Splunk app relies on:

https://msdn.microsoft.com/office-365/office-365-management-activity-api-reference

"Content older than 7 days cannot be retrieved."

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...