I am VERY interested in this. What did you use for your inputs from the UFA on the Mac endpoints? ... View more

Thanks renjith and cbastashutterfly for your information. ... View more

OK - Sorry for late response. So yes this for personal use but wondering if I can use Machine learning with Splunk Free? Is ML freely available with Splunk Free or do I need to pay license fees? ... View more

As per comment, this worked for me: Edit /opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/input_module_ms_o365_message_trace.py Manually set query_window_size and delay_throttle like so: def validate_input(helper, definition): input_mode = definition.parameters.get('input_mode') interval = definition.parameters.get('interval') query_window_size = 60 delay_throttle = 1440 # query_window_size = definition.parameters.get('query_window_size', None) # delay_throttle = definition.parameters.get('delay_throttle', None) start_date_time = definition.parameters.get('start_date_time', None) end_date_time = definition.parameters.get('end_date_time', None) start = None # Local instance of start date end = None # Local instance of end date ... View more