Folks,
I would like to know what name of index you recommend for o365 audit logs via the Microsoft o365 add-on for splunk. I know it doesn't matter, but I want to go with whatever most people are using.
Hi @trojan_81,
you can use the index name you prefer because index name isn't important and the choice to have only one or two indexed depends only on the retention time and user grants to your data.
In other words, you should put in the same index also different kind of data (a Splunk index isn't a database table!) but with the same retention time and the same user access grants.
Anyway, in my projects I used "o365" for all Office365 logs for the reasons I already described, but it isn't mandatory.
If you like, you can also use different indexes bt you have to remember this in you dashboards.
Ciao.
Giuseppe
Hi @trojan_81,
you can use the index name you prefer because index name isn't important and the choice to have only one or two indexed depends only on the retention time and user grants to your data.
In other words, you should put in the same index also different kind of data (a Splunk index isn't a database table!) but with the same retention time and the same user access grants.
Anyway, in my projects I used "o365" for all Office365 logs for the reasons I already described, but it isn't mandatory.
If you like, you can also use different indexes bt you have to remember this in you dashboards.
Ciao.
Giuseppe