Some time has gone by since the original poster posted the question, but I've experienced the same thing. Research seems to indicate that this is a limitation on the Microsoft side. What I've done until I can sort this out more is reduced the polling time period significantly (every minute), as was mentioned above. Note that there is the ability to poll not only through REST but also through the PowerShell applets (in general, not with this app that is), and those applets have the ability to use the -PageSize parameter to request up to 5,000 records. Not that it helps here, but it is interesting to note I think that the REST interface does not have that same capability, though according to MicroSoft it also uses PS on the back-end (within their environment). So far the app leaves a number of questions open for me, like: Is this too frequent for o365 polling? What happens when the Heavy Forwarder is down, are the message logs between the time period when it is down and when it comes up lost? How to ensure we’re getting all of the messages that are available and that none are dropped? If there is a delay in reporting for a message or messages, and the retrieval period passes for getting it, do we lose that/those message/messages? It may be that at my organization we may need to come up with a different solution if my review of the app leaves questions like the above open. I don't want to downplay the app authors work at all though! They did a great job, I appreciate their work, and they deserve kudos for it! ... View more

Separate multiple servers with commas. https://docs.splunk.com/Documentation/SA-LdapSearch/2.1.3/User/Theldap.confconfigurationfile Attribute : server= , ;... Description: Specifies the server or servers you want to connect to. Separate multiple servers with commas. Default: n/a ... View more