All Apps and Add-ons

Splunk TA O365 error loop- How to ask splunk to not go behind and start to collect in time?

New Member



i'm experiencing an issue with the splunk TA for O365 and in particular with the Sharepoint Management Activity Logs.

The issue is this:

1) 10:00 AM i activate the input

2) 10:01 AM Splunk starts to collect 10:00 AM events

3) 10:05 AM Splunk continues to collect Sharepoint logs but going behind in time! (9:59 AM, 9:58 AM and so on)

4) 11:00 AM Splunk is still collecting logs in the past but the temporary token expires and the input is closed and reopened

5) 11:00 AM Splunk reopen the input

6) 11:01 AM Splunk starts to collect 11:00 AM events

7) JUMP to step 3 but 1 hour later


May you know how to not ask splunk to go behind and starts to collect in time?





Labels (1)
0 Karma


@marcoRAD - On Office 365 App Inputs used to have that option but no longer present in the latest App that I can see.

You can create a Splunk support case to get resolution from the developer of the Add-on.


Please consider upvoting/accepting the answer it this helps!!!

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Hi Splunky people! We are excited to share the newest updates in Splunk Enterprise 9.3!Admins and Analyst can ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...