microsoft o365 add-on

Splunk Cloud Platform

My architecture is

Splunk Cloud and Splunk Enterprise - search heads and indexers

I have a onprem Heavy forwarder.

I want to try out the Splunk add-on for Microsoft o365 app.

Would it be recommended to install on the Heavy forwarder and have that reach out to o365 to retrieve the audit logs and then send it up to splunk cloud? Or can I have splunk cloud directly connect to my O365 tenant?

Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...