I am using the "Microsoft Office 365 Reporting Add-on for Splunk" (https://splunkbase.splunk.com/app/3720/#/details): We recently had an issue where, for some reason them timestamp recognition from 1.0 broke and all events were just getting the time of the pull as the time. This was down to the time configuration being applied to a sourcetype that our data was not being ingested against, and the sourcetype it was ingested against didn't define any specific time config. I can see that has now changed and it's all been placed into a single sourcetype with the time formatting. However, when reviewing the new 1.0.1 props.conf vs the 1.0 props.conf I can see the time format is different: v1.0 = TIME_FORMAT = %Y-%m-%dT%H:%M:%S v1.0.1 = TIME_FORMAT = %Y-%m-%dT%H:%M:%SZ I can't see anything on http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Commontimeformatvariables that would show me what the addition of the Z will do. There is a %Z for time zone recognition but our data does not contain this so is still not likely to work. I do have a change window tonight and have removed the Z from the configuration, I just wanted to see if there was a valid use of the Z when none of the data I am seeing has this at the end of the timestamp after "DateReceived: " TIA ... View more

I can't see any configuration options which would allow me to see attachment data for my O365 message tracking logs. Any idea if there is something that can be done on the O365 side? Or will this add-on not provide that ability? ... View more