re @Wiessiet I also looked at that for a while and found these 2 articles which helped me:  https://www.michev.info/blog/post/3180/exchange-api-permissions-missing https://www.michev.info/blog/post/4067/modern-authentication-oauth-support-for-the-reporting-web-service-in-office-365   In short, these are the steps: To get there, App Registrations -> Select our app -> API permissions Then Add a permission -> go to APIs my organization uses -> paste: Office 365 Exchange Online -> Click the Office 365 Exchange Online API section -> then Application permissions Paste the ReportingWebService.Read.All permissions and tick it + approve afterwards. It took me a while as well.  + the Global reader permission addition from Roles & admins -> Global Reader -> add assignments  -> paste the app name and  grant your app the role rights...  https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/manage-roles-portal ... View more

Hi @alaa_ahmad, as I said, it's possible to filter data before indexing to reduce the license consuption, but in this way you cannot use the discarded events (or part of them). If in your events there's a redendant part of the event that can be discarded, you have to find a regex to identify the relevant part to maintain or the not relevant part to remove. If you cannot, the only way is a larger license. As I said, if you want to remove the entire event you can follow the procedure described at https://docs.splunk.com/Documentation/SplunkCloud/latest/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues taking only the relavant data and discardinf the others or discarding a part of events. If instead you want to reduce the events, you can follow the anonymization procedure I described in the above message. In all these solutions, you have to identify one or more regexes to identify the the part of events to maintain or to discard. Ciao. Giuseppe ... View more