Resource usage for Office365 mscs:o365:management:activity

[d_lim]

Current specs of the server. I have enabled the 4 inputs (mgmt, audit_general, share_point, audit_exchange) for Office365 management logs, and set the threads to 16 each input.

My question is, could it be that the current resource(threads) are not enough to pull the logs, as I have an alert which is telling me the latency of logs indexed are up to ~40mins

Please correct me if I'm wrong, the current resource only provides 4core * 1thread = 4 threads to do the work.

[jconger · Accepted solution]

There can be latency on the Microsoft side from when an event is created to when it is available on the API.

From https://docs.microsoft.com/en-us/office/office-365-management-api/troubleshooting-the-office-365-man...

There is no guaranteed maximum latency for notification delivery (in other words, no SLA). Microsoft Support’s experience has been that most notifications are sent within one hour of the event. Often the latency is much shorter, but often it’s longer as well. This varies somewhat from workload to workload, but a general rule is that most notifications will be delivered within 24 hours of the originating event.

A really great search for this is from Ryan Kovar's .conf session on hunting the unknown in O365:

sourcetype="ms*" | eval time=_time |
eval itime=_indextime | eval
lag=(itime - time)/60 | stats
AVG(lag), MIN(lag), MEDIAN(lag),
MAX(lag) BY host sourcetype

https://github.com/rkovar/splunk-hunting-helpers/blob/master/conf18_MSFT_CLOUD_Talk/MSFT_cloud_searc...