Getting Data In

Splunk Add-on for Microsoft Office 365 Post Upgrade Seeing Some Issues

anandhalagaras1
Contributor

 Hi Team,

Actually we have 2 HF servers (A & B) in our environment  and in both the HF servers we have installed the Add-on "Splunk Add-on for Microsoft Office 365" and they were running with version 4.0.0

The input was enabled (active) state in (A) HF server whereas in (B) server we have done all the configurations but we have disabled the inputs. So logs would be getting ingested from this add-on from (A) server.

So recently we have upgraded our Splunk Add-on for Microsoft Office 365 from 4.0.0 to 4.3.0 in our HF server (B) server which is in disabled state.

So post upgrade I have enabled the inputs to check the log flow from (B) HF server and done a comparison with (A) server  and observed there is a drastic behavior of the log flow in both the servers and came to know there is a difference.

i.e. (A) HF server running with the older version of the add-on seems to be having less events for last 30 minutes whereas when we ran the same query where the add-on is upgraded in (B) server I can see huge events. 

So I have monitored the status for couple of days but still the same not sure whether the newly upgraded ones showing duplicate events or not and hence kindly help on how to get it fixed.

 

FYI. We have the same configuration on both the HF servers (Inputs and the rest).

 

So kindly help to check and update please. 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...