Splunk Add-on for Microsoft Office 365

macklaud · ‎01-10-2020

Hi,

I receive all the data from different tenants, but my data is not tagged to be able to use it in my Enterprise Security, although I have "Authentication and Change" data models enabled.

I have the "Splunk Add-on application for Microsoft Office 365" installed on an HF and the MSO365 application installed on my search head.
I have a cluster Splunk configuration with three indexers, the TA was copied to the master and also bundeled in the indexers.

Greetings.

macklaud · ‎01-28-2020

I have fixed copying the Ta on my Search Head.
Regards.

Splunk Add-on for Microsoft Office 365

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Index This | What travels the world but is also stuck in place?

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

Join the Conversation

Splunk Add-on for Microsoft Office 365

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Index This | What travels the world but is also stuck in place?

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...