When searching to see which sourcetypes are in the Endpoint data model, I am getting different results if I search: | tstats `summariesonly` c as count from datamodel="Endpoint" by index, sourcetype than when I search: | tstats `summariesonly` c as count from datamodel="Endpoint.Processes" by index, sourcetype Why wouldn't the sourcetypes under the Processes data set be included in the first search for sourcetypes in the Endpoint data model? Thanks. ... View more

I am attempting to configure the TA-MS_O365_Reporting app but can't seem to get the permissions correct. I've configured a user account in Azure AD called "splunk" and from the Exchange Admin console assigned it to a custom role with the four required permissions: Message Tracking View-Only Audit Logs View-Only Configuration View-Only Recipients But when I enable the input and then check Splunk's internal logs I see the following error: 401 Client Error: Unauthorized for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2021-10-27T20:08:33.583692Z'%20and%20EndDate%20eq%20datetime'2021-10-27T21:08:33.583692Z Is there something I am missing with regards to setting up the permissions? Thank you. ... View more