Re: O365 Duplicate events - Splunk Community

Getting Data In

Hello All,

I m getting duplicate events for my O365 logs.Have checked from my O365 side configurations and seems everything fine from O365 end.

Is this something need to corrected from Splunk side ??

Thanks,

Ramu.R

A possible better way of getting logs from O365/Azure: https://answers.splunk.com/answers/678660/how-to-get-logs-from-azure-and-o365-into-splunk.html

@marycordova

@mailmetoramu

I think you are facing Issue registered as known issue: ADDON-20076. Can you please check & confirm it? Or it something new.

https://docs.splunk.com/Documentation/AddOns/released/MSO365/Releasenotes

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...