Splunk Add-on for Microsoft Cloud Services - delete O365 Account

[pjr77]

Hi,

I am trying to remove the O365 Account setup that currently exists in my Splunk Add-on for Microsoft Cloud Services configuration as it was setup incorrectly using an admin account (for a user that has now left) rather than a service account among other issues.

When I try to delete it I get the following message

""O365" cannot be deleted because it is in use"

Where can i find where this is in use and remove it?

[vr2312]

@pjr77

I would reccomend the following :

1. Disable the App from the GUI
2. Log in to the CLI of the Search Head, proceed to disabled_apps directory and locate the 0365 app directory
3. Proceed to inputs.conf file, there will be the stanza where the account name would be mentioned, the value must be present in account=XXXX
4. Commend out or remove the account name or replace it with the service account you are trying to use.Or you can remove the whole input and configure from scratch from the Web GUI.
5. Enable App from GUI