Microsoft_o365_email_add_on_for_splunk

[mriemri14]

I have installed & configured  microsoft_o365_email_add_on_for_splunk but not getting log in splunk search. Please  help me how to fix it.

[livehybrid]

Hi @mriemri14 

Is "default" an index that definitely exists? If not then the data might end up in main or whatever has been configured in the lastChanceIndex of indexes.conf.

Its worth checking the _internal logs for any mention of message_trace - rather than specifically for the source containing message_trace, this is because if the Python file failed before it was able to create the log file then an error may present itself in a different log file.

If this doesnt help then I would try some other search terms such as "error" and "microsoft" and then narrow down the results to the time when you expected the input to execute.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[PaulPanther]

1. Choose a custom index that exists for the input

2. Check this index and verify if data flow in

3. If not, check the internal logs of the instance where the addon is configured