All Apps and Add-ons

How to get log from o365 on azure

sittipornbaycom
Observer

Hi

I would like to know step or document for integrate between splunk with o365 on azure, But it's want "Client Secret" from azure to insert into Splunk. Where can i get it ?

I try solution this URL:https://splunkbase.splunk.com/app/4055/ but it can't find any splunk URL for register on azure to get "Client Secret".

Thanks

Regards

0 Karma

dsoni_splunk
Splunk Employee
Splunk Employee

@sittipornbaycoms

Client Secret-key can be found over here:

Login to Azure platform >> Go to Azure Active Directory >> App Registartions >> Select your registered Application >> Select App >> Click on Settings >> Keys >> Generate Key

nickhills
Ultra Champion

Getting the o365/azure apps to work is a multi step process.

Once you have installed the Splunk add-in you need to configure an 'integration application' inside your Azure portal to allow your Splunk server to be authorized and authenticate.
https://docs.splunk.com/Documentation/AddOns/released/MSO365/ConfigureappinAzureAD

Then you have to configure your 365 tenant in Splunk with the relevant credentials from the step above.
https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configuretenant

When you have done both of those, you can configure your inputs to collect the required data.
https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configureinputs

If my comment helps, please give it a thumbs up!
0 Karma

sittipornbaycom
Observer

I try solution this but it can't connect with azure because it not have URL for splunk app register on azure to get "Client Secret".

0 Karma

nickhills
Ultra Champion

Have you done this?
(Step 1 from the first link)

https://docs.microsoft.com/en-us/office/office-365-management-api/get-started-with-office-365-manage...

If my comment helps, please give it a thumbs up!
0 Karma

sittipornbaycom
Observer

I try to follow Use the Azure Management Portal to register your application in Azure AD in "Get started with Office 365 Management APIs".
But I can not find the sign-on url and app id url in steps 7 Enter the appropriate App properties.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...