All Apps and Add-ons

Splunk to pull data from office 365 one drive

lmatilla
Explorer

I have been figuring a way to pull data from Office 365 One Drive storage. The dump data that needs to be indexed are stored in one drive. I've installed the Microsoft Cloud Services add-on but need help in connecting. Am I in the right path? Thanks!

jconger
Splunk Employee
Splunk Employee

The Splunk Add-on for Microsoft Cloud Services will pull activity data for OneDrive - things like file operations, user activity, file information, etc. The add-on does not index data that resides in OneDrive though. Can you dump the data to an Azure Storage account blob or file share? The add-on can index data from a blob or table. You could mount a file share to index data as well.

0 Karma

fahmed11
Explorer

Can you point me to documentation which shows that this add-on pulls OneDrive and other O365 application activity logs? So far it looks like O365 management api data, which doesn't contain user activity information.

0 Karma

jkat54
SplunkTrust
SplunkTrust

I don’t think the ms cloud services app pulls from OneDrive. Looks like you’ll have to script your own input:

https://docs.microsoft.com/en-us/onedrive/developer/

0 Karma

adonio
Ultra Champion

kindly read the documentation, very detailed step by step explanation. start here:
http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/About
installation:
http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Installationsteps
configuration start here and keeps on going for several pages:
http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/ConfigureappinAzureAD
hope it helps

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...