All Apps and Add-ons

MessageTrace sourcetype is incomplete

JScordo
Path Finder

I had sent and received 5 total test emails yesterday. Only two of those emails showed up int he logs and we confirmed from the office365 side of things that all 5 of those emails were received and verified delivered.

Is there a way to further test the app to make sure all logs are complete and all messages are being logged to sourcetype="ms:o365:reporting:messagetrace" ? Is there any further documentation that i'm missing for troubleshooting purposes.

I opened a support ticket requesting help but they stated that since this was a community app they couldn't help and closed out the case.

0 Karma

jconger
Splunk Employee
Splunk Employee

According to Microsoft, events can be delayed up to 24 hours -> https://msdn.microsoft.com/en-us/library/office/jj984335.aspx#Data%20granularity,%20persistence,%20a... So, it could be a delay in data availability from Microsoft. Or, it could be an error as well. Try the following search to see if there are any errors reporting back:

index=_internal sourcetype=*ms_o365_message_trace*
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...