How to index Outlook365 inbox?

[hexxamillion]

I have not seen any information or suggestions on how to index inbox messages from Outlook365. I understand it is just REST API but the microsoft API is not very friendly and requires refresh token which I seen from their communities is not so friendly to develop for either. Is there a Splunk app that works with Outlook365 that allows you to sign in using an account and grabs messages from the folder you need and index it?

If not, sounds like a great suggestion for Splunk to offer in Splunkbase. I am aware of the other Microsoft365 apps in Splunkbase but those look more for administration or management of the environment.

[dkeck]

Hi,

did you check this app, sounds like it can get you your inbox data?

https://splunkbase.splunk.com/app/3720/

[hexxamillion]

I did review that and again that one looks to be for more administration and not specific to outlook messages. Anywho, I finally figured out the Outlook365 REST API, got my access token. I was able to test getting inbox messages. So my plan now is to just use one of the Splunk apps that help to index or lookup REST API data. Ideally it would be nice to have an app specific to Outlook365.

[martin_mueller]

Yeah, the management data will tell you sender, recipient, subject etc - but not the entire content so it won't replace actually looking at the inbox. For making your own REST calls use the REST modular input add-on.

[hexxamillion]

Yeah. That's the app that I am trying to test with now. So far not having much success with that but still working on it.

[martin_mueller]

Feel free to post new questions specific to issues you have with the app separately.