Hi even you can mask that data in GUI, it didn't mean that you have really masked that data in Splunk. You must remember that after you have write it into bucket then it there and there is always a way to get it out in plain text if/when you have access to GUI and can write SPL. Even you are using search time props.conf and transforms.conf. The only way is remove that data from index and reindex it again. And even the delete command is not enough if you have access to buckets on CLI level, you could get thet data back. The only way is let it go away with set frozen time enough low, then wait and then reindex it. r. Ismo ... View more

Try to add file props.conf with the following content (in etc/apps/TA-MS_O365_Reporting/local/): [ms:o365:reporting:messagetrace] TZ = Zulu ... View more