Hi Team,
We have a request to index the O365 Message trace logs from Splunk .
So as recommended in Splunk blog we have followed the 1st step to retrieve the same.
https://www.splunk.com/blog/2017/10/05/splunking-microsoft-cloud-data-part-3.html
-->We have installed the Microsoft Office365 Reporting Add-on
-->As mentioned in the blog we have updated the configuration and their respective inputs.
Post which when we tried to fetch the logs with sourcetype as ms:o365:reporting:messagetrace we can able to see some events which got generated on Jan 12th 2018 and post which we couldn't able to see any new events for the same.
We are not sure about the exact issue in it.
We have provided the inputs and configurations as recommended. And I can able to see the logs for just one day and that means logs are getting ingested but dont know why it got indexed only for one day and post which there are no logs.
So kindly help on my query.
