Why splunk is indexing only o365:management:activity status= success only?

[gcusello]

Hi @karu0711,

could you share more infos?

what is the app you are speaking of ?

I suppose that you have a Singl Sign On environment, probably you see only the succeses after the main SSO that's always successful.

Ciao.

Giuseppe