Install and configure the Content Pack for Microsoft 365

Perform the following high-level steps to install and configure the Content Pack for Microsoft 365:

1. Install and configure the Splunk Add-on for Microsoft Office 365.
2. Install the content pack.
3. Review and tune KPI thresholds.

Prerequisites

Review the following prerequisites before installing the content pack:

Create a full backup of your ITSI environment

You can choose to create a full backup of your ITSI environment in the event you need to revert the install. For more information, see Overview of backing up and restoring ITSI KV store data in the Administration Manual.

Enable custom visualizations for sankey diagrams and punchcard visualizations

Install the following custom visualization apps from Splunkbase to ensure the visualizations display in this content pack:

• Punchcard Custom Visualization
• Splunk Sankey Diagram Custom Visualization
• Splunk Timeline Custom Visualization
• Semicircle Donut Chart Visualization

To learn more about custom visualizations, refer to the following resources:

• Using punchcards
• Using Sankey diagrams
• Timeline Installation

Install and configure the Splunk Add-on for Microsoft Office 365

This content pack relies on data from the Splunk Add-on for Microsoft Office 365. The add-on collects service status, service messages, and management activity logs from the Office 365 Management Activity API and the Office 365 Service Communications API.

You can safely install the Splunk Add-on for Microsoft Office 365 on all tiers of a distributed Splunk platform deployment, including heavy forwarders, indexers, or search heads.

To learn how to install and configure the add-on, see Installation and configuration overview for the Splunk Add-on for Microsoft Office 365.

Install the content pack

To install the Content Pack for Microsoft 365, you have to install the Splunk App for Content Packs. To follow detailed installation steps, see Install the Splunk App for Content Packs.

After you have installed the Splunk App for Content Packs, perform the following steps to install the content pack:

1. From the ITSI main menu, click Configuration > Data Integrations.
2. Select Content library.
3. Select the Microsoft 365 content pack.
4. Review what's included in the content pack and then click Proceed.
5. Configure the settings:
   1. Choose which objects to install: For a first-time installation, select the items you want to install and deselect any you're not interested in. For an upgrade, the installer identifies which objects from the content pack are new and which ones already exist in your environment from a previous installation. You can selectively choose which objects to install from the new version or install them all.
   2. Choose a conflict resolution rule for the objects you install: For upgrades or subsequent installs, decide what happens to duplicate objects introduced from the content pack. Choose from the following options:
      1. Install as new: Any existing identical objects in your environment remain intact.
      2. Replace existing: Existing identical objects are replaced with those from the new installation. Any changes you previously made to these objects are overwritten.
   3. Import as enabled: Select whether to install objects as enabled or to leave them in their original state. Importing objects as disabled will ensure that your environment doesn't break from the addition of new content. This setting only applies to services, correlation searches, and aggregation policies. All other objects, such as KPI base searches and saved searches, are installed in their original state regardless of the option you choose.
   4. Modify status of saved searches: This option will be displayed only if the content pack contains saved searches. By default, saved searches included in a content pack are in deactivated state. Within this configuration, you have the flexibility to perform the following operations:
   1. Activate all saved searches: By selecting this option, you can activate all the saved searches associated with the content pack.
   2. Deactivate all saved searches: By selecting this option, you can deactivate all the saved searches associated with the content pack.
   3. Retain current status of saved searches: This option allows you to preserve the existing status of the saved searches within the content pack.
   5. Add a prefix to your new objects: Optionally, append a custom prefix to each object installed from the content pack. For example, you might prefix your objects with CP- to indicate they came from a content pack. This option can help you locate and manage the objects after installation.
   6. Backfill service KPIs: Optionally backfill your ITSI environment with the previous seven days of KPI data. Consider enabling backfill if you want to configure adaptive thresholding and predictive analytics for the new services. This setting only applies to KPIs, not service health scores.
6. When you're satisfied with your selections, click Install selected.
7. Click Install to confirm the installation. When the installation completes you can view all objects that were successfully installed in your environment. A green checkmark on the Data Integrations page indicates which content packs you've already installed. The content pack tile also shows the current status of all the saved searches of the content pack.

Review and tune KPI thresholds

Aggregate and per-entity thresholds for the KPIs in this content pack have pre-tuned thresholds representing best practices. You can review the KPIs in each service and configure their aggregate and per-entity thresholds values to alternate defaults based on your use case. Some KPIs, such as basic performance counters like CPU utilization, have universal best practices for threshold configuration. Others are specific to your deployment.

For instructions on tuning the KPI thresholds, see Configure KPI thresholds in ITSI in the Service Insights Manual .

For a full list of the KPIs in this content pack, see the KPI reference for the Content Pack for Microsoft 365.

KPI alerting

ITSI generates notable events in Episode Review based on the alerting rules you configure. KPI alerting is enabled for some services so you can receive alerts when aggregate KPI threshold values change. You can turn off this alerting behavior or tune the parameters based on how many alerts you want to receive.

For more information about KPI alerting, see Receive alerts when KPI severity changes in ITSI in the Service Insights Manual. .

Anomaly detection

Anomaly detection uses machine learning algorithms to model KPI behavior. If the KPI diverges from the normal pattern, ITSI creates a notable event in Episode Review. Some KPIs have anomaly detection enabled.

For more information about anomaly detection, see Apply anomaly detection to a KPI in ITSI in the Service Insights Manual.

Next step

Once you install and configure the Content Pack for Microsoft 365, you can start using the dashboards and visualizations in the content pack to monitor your environment. For instructions on using the content pack, see Use the Content Pack for Microsoft 365.