Hi
I configured this app with data coming in from
Splunk Add-on for Microsoft Office 365
app/4055/
and the Microsoft Office 365 Reporting Add-on
app/3720 for message trace.
I get the Azure data in but the any query looking at Sharepoint and Exchange data doesn't light up the dashboard. Doing some investigation, I found the only workload I have coming in is AzureActiveDirectory. While the other panels are looking for Workload = Sharepoint and Workload = Exchange. We do use both Sharepoint and Exchange and I was wondering if there was anything specific on the Azure side that is missing to pull these additional workloads in?
For the Office 365 add-on, you will need to configure one input per content type. It sounds like you only have an input for Audit.AzureActiveDirectory
Thanks Jason, We had actually saw that about 15 min after I posted