All Apps and Add-ons

Resource usage for Office365 mscs:o365:management:activity

d_lim
Path Finder

alt text

Current specs of the server. I have enabled the 4 inputs (mgmt, audit_general, share_point, audit_exchange) for Office365 management logs, and set the threads to 16 each input.

My question is, could it be that the current resource(threads) are not enough to pull the logs, as I have an alert which is telling me the latency of logs indexed are up to ~40mins

Please correct me if I'm wrong, the current resource only provides 4core * 1thread = 4 threads to do the work.

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

There can be latency on the Microsoft side from when an event is created to when it is available on the API.

From https://docs.microsoft.com/en-us/office/office-365-management-api/troubleshooting-the-office-365-man...

There is no guaranteed maximum latency for notification delivery (in other words, no SLA). Microsoft Support’s experience has been that most notifications are sent within one hour of the event. Often the latency is much shorter, but often it’s longer as well. This varies somewhat from workload to workload, but a general rule is that most notifications will be delivered within 24 hours of the originating event.

A really great search for this is from Ryan Kovar's .conf session on hunting the unknown in O365:

sourcetype="ms*" | eval time=_time |
eval itime=_indextime | eval
lag=(itime - time)/60 | stats
AVG(lag), MIN(lag), MEDIAN(lag),
MAX(lag) BY host sourcetype

https://github.com/rkovar/splunk-hunting-helpers/blob/master/conf18_MSFT_CLOUD_Talk/MSFT_cloud_searc...

View solution in original post

0 Karma

jconger
Splunk Employee
Splunk Employee

There can be latency on the Microsoft side from when an event is created to when it is available on the API.

From https://docs.microsoft.com/en-us/office/office-365-management-api/troubleshooting-the-office-365-man...

There is no guaranteed maximum latency for notification delivery (in other words, no SLA). Microsoft Support’s experience has been that most notifications are sent within one hour of the event. Often the latency is much shorter, but often it’s longer as well. This varies somewhat from workload to workload, but a general rule is that most notifications will be delivered within 24 hours of the originating event.

A really great search for this is from Ryan Kovar's .conf session on hunting the unknown in O365:

sourcetype="ms*" | eval time=_time |
eval itime=_indextime | eval
lag=(itime - time)/60 | stats
AVG(lag), MIN(lag), MEDIAN(lag),
MAX(lag) BY host sourcetype

https://github.com/rkovar/splunk-hunting-helpers/blob/master/conf18_MSFT_CLOUD_Talk/MSFT_cloud_searc...

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...