Getting Data In

How to index Outlook365 inbox?

hexxamillion
Explorer

I have not seen any information or suggestions on how to index inbox messages from Outlook365. I understand it is just REST API but the microsoft API is not very friendly and requires refresh token which I seen from their communities is not so friendly to develop for either. Is there a Splunk app that works with Outlook365 that allows you to sign in using an account and grabs messages from the folder you need and index it?

If not, sounds like a great suggestion for Splunk to offer in Splunkbase. I am aware of the other Microsoft365 apps in Splunkbase but those look more for administration or management of the environment.

Tags (2)
0 Karma

dkeck
Influencer

Hi,

did you check this app, sounds like it can get you your inbox data?

https://splunkbase.splunk.com/app/3720/

0 Karma

hexxamillion
Explorer

I did review that and again that one looks to be for more administration and not specific to outlook messages. Anywho, I finally figured out the Outlook365 REST API, got my access token. I was able to test getting inbox messages. So my plan now is to just use one of the Splunk apps that help to index or lookup REST API data. Ideally it would be nice to have an app specific to Outlook365.

martin_mueller
SplunkTrust
SplunkTrust

Yeah, the management data will tell you sender, recipient, subject etc - but not the entire content so it won't replace actually looking at the inbox. For making your own REST calls use the REST modular input add-on.

0 Karma

hexxamillion
Explorer

Yeah. That's the app that I am trying to test with now. So far not having much success with that but still working on it.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Feel free to post new questions specific to issues you have with the app separately.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...