I'm using the Splunk Add-on for Microsoft Cloud Services to ingest logs from Office 365. Specifically, I'm getting the Exchange Online Audit and Azure AD Audit logs.
After the O365 Management API input was successfully created, 7 days of log history was pulled into Splunk and new logs are rolling in, which is a great start. However, I would like to pull in more historical data. I'm looking for at least 30 days, or better yet, the entirety of log data retention (e.g., up to 90 days). I don't see any configurable options in the app itself, and I poked around in the app's .conf files a bit, but didn't see anything that looked like an option to change the number of days to be ingested. I'm wondering if it may be hard-coded somewhere in the app's logic, where it could be updated to suit my needs.