Hello,
plugin is configured to get Office 365 audit logs (Exchange, Sharepoint, Teams, etc.).
The problem is that from time to time it's just stops ingesting some of inputs.
If then input is manually disabled and enabled from a GUI, ingesting is working again.
Internal log shows no errors, just standard messages like: ..success, ..found, ..available content.
Then after a gap there is a message: Loop has been aborted (which is probably according to disabling/enabling input). After that there are standard messages again.
Has anybody had similar problem with this plugin and what could be a solution?
Would you suggest using another app: Splunk Add-on for Microsoft Cloud Services (https://splunkbase.splunk.com/app/3110/#/overview) ?
Regards,
Wojtek
... View more