Hello, two of our Splunk apps "Splunk Add-on for Microsoft Cloud Services" and "Splunk Add-on for Office 365" are no longer collecting data. It looks like they stopped working June 30. I checked the client secret in the Azure App Registrations panel and it had not expired. I went ahead and created a new key anyway and updated the two Splunk app configurations with the new key, but they still aren't collecting any data. I checked index="_internal" log_level=ERROR but didn't really see anything that stood out specific to these apps. Any suggestions on settings I can check, other logs to examine, etc? ... View more

I have the following dashboard table: <table> <title>messageIdTok=$messageIdTok$ userIdTok=$userIdTok$ subjectTok=$subjectTok$</title> <search base="baseSearch"> <query>| search subject="*$subjectTok$*" UserId="$userIdTok$" ipAddress="$ipAddressTok$" messageId="$messageIdTok$" | table _time,UserId,subject,Operation,messageId,ClientInfoString,ipAddress</query> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <condition field="subject"> <set token="subjectTok">$row.subject$</set> <set token="messageIdTok">*</set> <set token="userIdTok">*</set> <set token="ipAddressTok">*</set> </condition> <condition field="messageId"> <set token="messageIdTok">$click.value$</set> <set token="subjectTok">*</set> <set token="userIdTok">*</set> <set token="ipAddressTok">*</set> </condition> <condition field="UserId"> <set token="messageIdTok">*</set> <set token="subjectTok">*</set> <set token="userIdTok">$row.UserId$</set> <set token="ipAddressTok">*</set> </condition> </drilldown> </table> In the "messageId" drilldown condition, i'm using $click.value$. But when I do this, clicking the cell always sets the messageIdTok to the value in the first column (_time in this case). I also notice that when i have table option "drilldown" set to "cell", moving the mouse over the table always highlights the cell I'm hovering over as well as the first cell of that row (video here).  Any suggestions on how to correct this behavior? ... View more

How do I extract these name/value elements from the "DeviceProperties" field below? Need it to be in table format such that the column names are the "Name" values and the rows of each column are the "Value" values.    ... View more

Hi, we've configured the "Message Trace" input type for Splunk Add-On for Microsoft Office 365 but don't seem to be receiving any data. Other input types (Mailbox, Management Activity, etc) are working. Not sure what the problem is, any suggestions on how to troubleshoot?  I did notice a discrepancy when viewing the current configuration of the input versus the options available when editing the input (the same value is reported "in days" in one place and "in minutes" in another): Could it be my delay throttle truly is set to 1440 days rather than minutes? I believe I have all the API permissions set correctly, but let me know if this doesn't look right:   ... View more

Hello, trying to figure out why this eval statement testing for a null value always evaluates to "true", even when the field does contain data: Here is what the data looks like in the results:     ... View more