All Apps and Add-ons

Office 365 logs - ingest more than 7 days history

schanson
New Member

I'm using the Splunk Add-on for Microsoft Cloud Services to ingest logs from Office 365. Specifically, I'm getting the Exchange Online Audit and Azure AD Audit logs.

After the O365 Management API input was successfully created, 7 days of log history was pulled into Splunk and new logs are rolling in, which is a great start. However, I would like to pull in more historical data. I'm looking for at least 30 days, or better yet, the entirety of log data retention (e.g., up to 90 days). I don't see any configurable options in the app itself, and I poked around in the app's .conf files a bit, but didn't see anything that looked like an option to change the number of days to be ingested. I'm wondering if it may be hard-coded somewhere in the app's logic, where it could be updated to suit my needs.

0 Karma

dstefan
New Member
0 Karma

schanson
New Member

Thanks for the input, but I don't think that is the constraint. When I log into the web console or use Powershell to pull logs, there is retention going back for nearly a year.

Looks like the limitation is in the O365 Management API that the Splunk app relies on:

https://msdn.microsoft.com/office-365/office-365-management-activity-api-reference

"Content older than 7 days cannot be retrieved."

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...