All Apps and Add-ons

How to get workloads besides AzureActiveDirectory?

bsimmons_splunk
Splunk Employee
Splunk Employee

Hi
I configured this app with data coming in from
Splunk Add-on for Microsoft Office 365
app/4055/
and the Microsoft Office 365 Reporting Add-on
app/3720 for message trace.

I get the Azure data in but the any query looking at Sharepoint and Exchange data doesn't light up the dashboard. Doing some investigation, I found the only workload I have coming in is AzureActiveDirectory. While the other panels are looking for Workload = Sharepoint and Workload = Exchange. We do use both Sharepoint and Exchange and I was wondering if there was anything specific on the Azure side that is missing to pull these additional workloads in?

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

For the Office 365 add-on, you will need to configure one input per content type. It sounds like you only have an input for Audit.AzureActiveDirectory

alt text

View solution in original post

0 Karma

jconger
Splunk Employee
Splunk Employee

For the Office 365 add-on, you will need to configure one input per content type. It sounds like you only have an input for Audit.AzureActiveDirectory

alt text

0 Karma

bsimmons_splunk
Splunk Employee
Splunk Employee

Thanks Jason, We had actually saw that about 15 min after I posted

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...