Getting Data In

Getting Microsoft Teams Data into Splunk?

tomapatan
Communicator

Hi,

I`m following this article in an attempt to ingest Teams data into Splunk and I need some help with testing the webhook - can someone confirm what the webhook URL is ?

 

 

 

 

curl WEBHOOK_ADDRESS -d '{"value": "test"}'

 

 

 

 

 

Also, looking at the documentation for the Teams Add-on for Splunk it states that "theTeams Webhook is not available for Splunk Cloud installations." - has anyone found an alternative solution for Cloud Deployments ?

We use Splunk in a hybrid (cloud + on prem) environment.

Many thanks.

Labels (1)
Tags (1)
0 Karma
1 Solution

tomapatan
Communicator
0 Karma

tomapatan
Communicator
0 Karma

tomapatan
Communicator

Thanks Paul,

The Microsoft Teams Add-on for Spunk includes a Microsoft Teams-specific webhook that I`ve configured, but the documentation (link above) does not include the webhook URL for me to test., which is what I`m after.

0 Karma

PaulPanther
Builder

Okay, so you've  already defined a webhook address that is pointing directly to your data collection node or any load balancer, reverse proxy, or tunnel in front.

Then replace the WEBHOOK_ADDRESS placeholder with your defined webhook address and execute the curl command. 

The test is successful if your test event is searchable with 

sourcetype="m365:webhook"

 

0 Karma

tomapatan
Communicator

Hi Paul,

Unfortunately I didn`t get that far - when I created a new input in Splunk - add Teams Webhook, there`s no option to specify the URL, as per the screenshot attached. So I`m not sure where/how the webhook needs to be defined.

0 Karma

PaulPanther
Builder

Ahh, got it. You have to define 3 different Inputs :

1. Create a Teams Webhook input

2. Create a Teams Subscription input

3. Create a Teams Call Record input

As described in the details of Microsoft Teams Add-on for Splunk | Splunkbase

In the Subscription input you can define the Webhook URL.

0 Karma

PaulPanther
Builder

You must provide the webhook address that you wanna call from Microsoft Teams. How you do the configuration on Microsoft Teams is described here: Create and add an outgoing webhook in Teams - Microsoft Support

 

Regarding Splunk Cloud the documentation recommends Azure Function as an alternative:

Note: The Teams Webhook is not available for Splunk Cloud installations. Consider Azure Functions as an alternative.

Microsoft Teams Add-on for Splunk | Splunkbase

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...