Microsoft Office 365 Reporting Add-on for Splunk: Are there configuration options to see attachment data?

[TWiseOne]

I can't see any configuration options which would allow me to see attachment data for my O365 message tracking logs.

Any idea if there is something that can be done on the O365 side? Or will this add-on not provide that ability?

[jconger · Accepted solution]

This add-on uses the Office 365 reporting web service Message Trace Report -> https://msdn.microsoft.com/en-us/library/office/jj984335.aspx Unfortunately, there is not attachment data coming back from this API.