All Apps and Add-ons

Resource usage for Office365 mscs:o365:management:activity

d_lim
Path Finder

alt text

Current specs of the server. I have enabled the 4 inputs (mgmt, audit_general, share_point, audit_exchange) for Office365 management logs, and set the threads to 16 each input.

My question is, could it be that the current resource(threads) are not enough to pull the logs, as I have an alert which is telling me the latency of logs indexed are up to ~40mins

Please correct me if I'm wrong, the current resource only provides 4core * 1thread = 4 threads to do the work.

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

There can be latency on the Microsoft side from when an event is created to when it is available on the API.

From https://docs.microsoft.com/en-us/office/office-365-management-api/troubleshooting-the-office-365-man...

There is no guaranteed maximum latency for notification delivery (in other words, no SLA). Microsoft Support’s experience has been that most notifications are sent within one hour of the event. Often the latency is much shorter, but often it’s longer as well. This varies somewhat from workload to workload, but a general rule is that most notifications will be delivered within 24 hours of the originating event.

A really great search for this is from Ryan Kovar's .conf session on hunting the unknown in O365:

sourcetype="ms*" | eval time=_time |
eval itime=_indextime | eval
lag=(itime - time)/60 | stats
AVG(lag), MIN(lag), MEDIAN(lag),
MAX(lag) BY host sourcetype

https://github.com/rkovar/splunk-hunting-helpers/blob/master/conf18_MSFT_CLOUD_Talk/MSFT_cloud_searc...

View solution in original post

0 Karma

jconger
Splunk Employee
Splunk Employee

There can be latency on the Microsoft side from when an event is created to when it is available on the API.

From https://docs.microsoft.com/en-us/office/office-365-management-api/troubleshooting-the-office-365-man...

There is no guaranteed maximum latency for notification delivery (in other words, no SLA). Microsoft Support’s experience has been that most notifications are sent within one hour of the event. Often the latency is much shorter, but often it’s longer as well. This varies somewhat from workload to workload, but a general rule is that most notifications will be delivered within 24 hours of the originating event.

A really great search for this is from Ryan Kovar's .conf session on hunting the unknown in O365:

sourcetype="ms*" | eval time=_time |
eval itime=_indextime | eval
lag=(itime - time)/60 | stats
AVG(lag), MIN(lag), MEDIAN(lag),
MAX(lag) BY host sourcetype

https://github.com/rkovar/splunk-hunting-helpers/blob/master/conf18_MSFT_CLOUD_Talk/MSFT_cloud_searc...

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...