I was also having this issue trying to get Audit.General logs. It turns out there is a python script packaged with the app that sets a time-delta threshold. I fixed this by lowering the threshold from the default 7 days (packaged with the app) to match our environment (which happens to be six days). The script is: bin/splunk_ta_o365/modinputs/management_activity.py. The line I had to change was: last_updated_time = datetime.utcfromtimestamp(now) - timedelta(days=7) Not the ideal solution, but it seems to work. I hope the next version of the app makes this a configurable parameter. ... View more