I am currently ingesting O365 Exchange and Mimecast logs in to Splunk, but I would like to start ingesting any links that are contained in the body of emails to allow additional security checks. Has anyone come across a good way to achieve this? Thanks ... View more

I have encountered a strange issue when clicking on an "interesting field" in the left side bar under the events tab, usually the pop out menu would show me up to 10 values, along with a count and percentage of the events returned which have the value. I am seeing the top values that the returned events have, but the count and percent is wrong. My search returns 135 events, when I click on the result field, I am shown a row for each of the values: I have never seen more than 100% displayed in the % column of this pop out menu. Has anyone come across this before? I'm worried we've misconfigured something somewhere which might be causing this. Thanks ... View more