Hi Team,
Actually we have 2 HF servers (A & B) in our environment and in both the HF servers we have installed the Add-on "Splunk Add-on for Microsoft Office 365" and they were running with version 4.0.0
The input was enabled (active) state in (A) HF server whereas in (B) server we have done all the configurations but we have disabled the inputs. So logs would be getting ingested from this add-on from (A) server.
So recently we have upgraded our Splunk Add-on for Microsoft Office 365 from 4.0.0 to 4.3.0 in our HF server (B) server which is in disabled state.
So post upgrade I have enabled the inputs to check the log flow from (B) HF server and done a comparison with (A) server and observed there is a drastic behavior of the log flow in both the servers and came to know there is a difference.
i.e. (A) HF server running with the older version of the add-on seems to be having less events for last 30 minutes whereas when we ran the same query where the add-on is upgraded in (B) server I can see huge events.
So I have monitored the status for couple of days but still the same not sure whether the newly upgraded ones showing duplicate events or not and hence kindly help on how to get it fixed.
FYI. We have the same configuration on both the HF servers (Inputs and the rest).
So kindly help to check and update please.
