Getting Data In

How to index Outlook365 inbox?

hexxamillion
Explorer

I have not seen any information or suggestions on how to index inbox messages from Outlook365. I understand it is just REST API but the microsoft API is not very friendly and requires refresh token which I seen from their communities is not so friendly to develop for either. Is there a Splunk app that works with Outlook365 that allows you to sign in using an account and grabs messages from the folder you need and index it?

If not, sounds like a great suggestion for Splunk to offer in Splunkbase. I am aware of the other Microsoft365 apps in Splunkbase but those look more for administration or management of the environment.

Tags (2)
0 Karma

dkeck
Influencer

Hi,

did you check this app, sounds like it can get you your inbox data?

https://splunkbase.splunk.com/app/3720/

0 Karma

hexxamillion
Explorer

I did review that and again that one looks to be for more administration and not specific to outlook messages. Anywho, I finally figured out the Outlook365 REST API, got my access token. I was able to test getting inbox messages. So my plan now is to just use one of the Splunk apps that help to index or lookup REST API data. Ideally it would be nice to have an app specific to Outlook365.

martin_mueller
SplunkTrust
SplunkTrust

Yeah, the management data will tell you sender, recipient, subject etc - but not the entire content so it won't replace actually looking at the inbox. For making your own REST calls use the REST modular input add-on.

0 Karma

hexxamillion
Explorer

Yeah. That's the app that I am trying to test with now. So far not having much success with that but still working on it.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Feel free to post new questions specific to issues you have with the app separately.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!