Hey @sahiltcs , have you checked out Splunk's use case catalogue, latern.splunk.com A quick search has led me to this https://lantern.splunk.com/Splunk_Product_Learning_Guides/Splunk_IT_Service_Intelligence/Gaining_better_visibility_in_Microsoft_O365 For further more detailed view of a remote workforce, check out Splunk's Remote Work Insights. Link to a databrief here  HTH  James ... View more

Hi @lukasmecir, I think you should raise a support case for this issue.  In fixed issues for Splunk 8.1.2, I found this promising note. 2021-01-29 SPL-198149, SPL-199358 KVStore lookup indexing leads to slow search performance and intermittent errors in searches. See here https://docs.splunk.com/Documentation/Splunk/8.1.2/ReleaseNotes/Fixedissues#Highlighted_issues but in 8.2.2  2021-05-21 SPL-206067 With large KVstore temporal lookups that are replicated to indexers, turning ON enable_splunkd_kv_lookup_indexing may lead to indexer crash https://docs.splunk.com/Documentation/Splunk/8.2.2/ReleaseNotes/KnownIssues#Distributed_search_and_search_head_clustering_issues So please raise a support case and get the SME's view on how best to address this. Cheers ... View more