Splunk Add-on for Microsoft Office 365 --Why can't I index files over 7 days old?

[lessthan80]

Splunk Add-on for Microsoft Office 365 -- I'm unable to index files over 7 days old.

Where can this configuration be changed in the Add-on?

Splunk Add-on for Microsoft Office 365
Version:
2.0.2
Build: 1

Splunk
Version:8.1.5

[lessthan80]

This specifc Add-on 
https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configureinputs#

states
The retention period for historical data is 7 days.
We had an authentication failure that was not corrected for about 3 weeks; and once corrected these logs did not index anything older than 7 days.  I searched the .conf files for any configuration that might have limited the lookback time and did not find any.

I'm hoping there is a configuration in this add-on that can be adjusted to pick up these older than 7 days logs.

thanks for your input.

[richgalloway · Accepted solution]

That add-on uses a Microsoft API to collect data.  How long that data remains available likely is controlled by Microsoft.  Your O365 admin may be able to provide further details.

[lessthan80]

i had started looking at documentation for the API and found
https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-service-communications-...

which states the historical is today - 7

thanks for guiding me to the correct location for the configuration.  I will follow up with O365 support to see if this can or should be changed.

calling this question answered

[richgalloway]

Please elaborate.  Why are you unable to index the files?  What error message(s) do you get?  Have you checked the add-on's inputs.conf file for an ignoreOlderThan setting?