Suddenly transforming commands stopped working unless I search in verbose mode. What could cause this issue? This only happens with newly indexed events, but events seems identical. Even a simple | stats count fails. Regards, G. ... View more

Does someone knows if it is still possible to pull the Exchange message tracking logs using the Microsoft Office 365 Reporting Add-on for Splunk? I have followed the setup instructions and it worked for 8 day circa then stopped working for a month, then suddenly started working again, but just for a day. Examining the logs I've noticed messages saying "HTTP 401 Unauthorized ... call not properly authenticated", but I've never changed credentials. In another question (https://community.splunk.com/t5/All-Apps-and-Add-ons/O365-message-tracking-logs/m-p/487992) I've read that " O365 no longer supports basic authentication for O365 to get those log files.", but it worked for a while so I do not understand. Did someone came up with a solution for this? Regards, -G. ... View more