Exchange Online Logs in Splunk

[ringo227]

Hi,

I would like to use Splunk to gather email metrics. For example, what email was send, to whom, whether it had an attachment, size of email and/or attachment. Seems like the O365 logs are pretty bad. E.g. The send activity doesn't even capture the recipient. Has anyone had any luck capturing this data? Appreciate any help you can provide.

Thanks,

Rich

[VatsalJagani]

@ringo227 - Only way currently available on Splunkbase to collect the email logs is with Office 365 Add-on.

https://splunk.github.io/splunk-add-on-for-microsoft-office-365/ConfigureMessageTraceInput/

https://splunkbase.splunk.com/app/4055 

I hope this helps!!!