All Apps and Add-ons

Set Host Field for Inputs

David16
Engager

Hello,

I am pulling data from two separate Azure instances and I need a way to differentiate the logs between the indexes. I don't want to put the data in separate indexes, and the source is the Microsoft API for both environments. Is there a way to manually set the host field for each input? I checked the splunk_ta_ms_o365_client_management_api_inputs.conf (and other confs) and I didn't see an option to set the host value.

Thank you.

0 Karma

deepashri_123
Motivator

Hey@David16,

You can refer this doc:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Setadefaulthostforaninput

Let me know if this helps!!

0 Karma

jp_elizabeth
Explorer

Hello, have you tried differentiating by using the OrganiszationId Field? This should be different for each tenant that you're pulling data from.

0 Karma

David16
Engager

I thought of that, but I don't see the organization ID in every event.

0 Karma

jp_elizabeth
Explorer

Just to clarify, the events that don't have organization ID, are they from the o365 management API as well or is that including storage table and storage blob?

if you run the below search how many API sources does it return?

index=(your index) sourcetype=(microsoft api) | rex field=source "/(?.*)/activity" | stats count by apisource

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...