Splunk Search

Including O365 UserAgent data in search

funkychickin
New Member

Hi all,

I'm having trouble getting O365 UserAgent data to show up in a search. Currently, my search looks like:

sourcetype="o365:management:activity" OR sourcetype="ms:o365:management" Workload=AzureActiveDirectory Operation=UserLoggedIn
| dedup user
| iplocation ActorIpAddress
| table user, City, Region,UserAgent, ActorIpAddress, _time 
| rename  ActorIpAddress AS IP  
| search NOT Region=Pennsylvania 
| sort-_time

I've tried a few different methods of getting UserAgent data into the table view but haven't had any luck. The data is in the Event log, I just can't seem to extract it. Any suggestions would be greatly appreciated!

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Debug SPL by starting with the smallest part of the query and adding bits until it breaks. The last thing added most likely is the problem. In your example, start with sourcetype="o365:management:activity" OR sourcetype="ms:o365:management" Workload=AzureActiveDirectory Operation=UserLoggedIn then add |dedup user and so on until you get no results. Make sure all expect fields are present with values in the expected form.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...