Hola, que sourcetype utilizó?? ... View more

The Office 365 Reporting web service uses basic authentication. Which means that you have to send a Authorization header with your request. The header value is "Basic base64encode(username:password)", look up basic authentication and you will see examples. I don't see a way to send this header using workflow actions. If you don't write your own python scripts, you should check out: Splunk REST API Modular Input app -https://splunkbase.splunk.com/app/1546/ REST storage/passwords Manager for Splunk - https://splunkbase.splunk.com/app/4013/ If you want to index messagetrace and messagetracedetail data, you need to request the trace data, take the values from the trace and put them in the tracedetail request. You can set this up to run all the time and index all mail trace and tracedetail events. ... View more