All Apps and Add-ons

Resource usage for Office365 mscs:o365:management:activity

Path Finder

alt text

Current specs of the server. I have enabled the 4 inputs (mgmt, audit_general, share_point, audit_exchange) for Office365 management logs, and set the threads to 16 each input.

My question is, could it be that the current resource(threads) are not enough to pull the logs, as I have an alert which is telling me the latency of logs indexed are up to ~40mins

Please correct me if I'm wrong, the current resource only provides 4core * 1thread = 4 threads to do the work.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

There can be latency on the Microsoft side from when an event is created to when it is available on the API.

From https://docs.microsoft.com/en-us/office/office-365-management-api/troubleshooting-the-office-365-man...

There is no guaranteed maximum latency for notification delivery (in other words, no SLA). Microsoft Support’s experience has been that most notifications are sent within one hour of the event. Often the latency is much shorter, but often it’s longer as well. This varies somewhat from workload to workload, but a general rule is that most notifications will be delivered within 24 hours of the originating event.

A really great search for this is from Ryan Kovar's .conf session on hunting the unknown in O365:

sourcetype="ms*" | eval time=_time |
eval itime=_indextime | eval
lag=(itime - time)/60 | stats
AVG(lag), MIN(lag), MEDIAN(lag),
MAX(lag) BY host sourcetype

https://github.com/rkovar/splunk-hunting-helpers/blob/master/conf18_MSFT_CLOUD_Talk/MSFT_cloud_searc...

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

There can be latency on the Microsoft side from when an event is created to when it is available on the API.

From https://docs.microsoft.com/en-us/office/office-365-management-api/troubleshooting-the-office-365-man...

There is no guaranteed maximum latency for notification delivery (in other words, no SLA). Microsoft Support’s experience has been that most notifications are sent within one hour of the event. Often the latency is much shorter, but often it’s longer as well. This varies somewhat from workload to workload, but a general rule is that most notifications will be delivered within 24 hours of the originating event.

A really great search for this is from Ryan Kovar's .conf session on hunting the unknown in O365:

sourcetype="ms*" | eval time=_time |
eval itime=_indextime | eval
lag=(itime - time)/60 | stats
AVG(lag), MIN(lag), MEDIAN(lag),
MAX(lag) BY host sourcetype

https://github.com/rkovar/splunk-hunting-helpers/blob/master/conf18_MSFT_CLOUD_Talk/MSFT_cloud_searc...

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!