Microsoft o365 app for splunk

[trojan_81]

Folks,

I would like to know what name of index you recommend for o365 audit logs via the Microsoft o365 add-on for splunk.  I know it doesn't matter, but I want to go with whatever most people are using. 

[gcusello · Accepted solution]

Hi @trojan_81,

you can use the index name you prefer because index name isn't important and the choice to have only one or two indexed depends only on the retention time and user grants to your data.

In other words, you should put in the same index also different kind of data (a Splunk index isn't a database table!) but with the same retention time and the same user access grants.

Anyway, in my projects I used "o365" for all Office365 logs for the reasons I already described, but it isn't mandatory.

If you like, you can also use different indexes bt you have to remember this in you dashboards.

Ciao.

Giuseppe

[gcusello]

Hi @trojan_81,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉