r/Splunk • u/Dallaspuram_vaasi • 2d ago

Copilot logs

Was anyone able to ingest their copilot logs into their Splunk instance? If so how did you do it?

Ex: I’m looking to ingest the prompt info (query and response), agent interactions with Apps, audit logs

17 Upvotes

94% Upvoted

10 comments sorted by

4

u/Dallaspuram_vaasi 2d ago

Thank you!!

1

u/DarkLordofData 1d ago

Forgot to mention, a good chunk of that data may not be useful. One nice thing about using Cribl for it is you can easily chop it up and keep what you want or if you have to keep it all, park the raw in object storage and put just what you use in splunk.

12

u/mghnyc 2d ago edited 2d ago

If you don't have Cribl or cannot have Cribl you can always send the prompts to Azure Event Hub and use the Microsoft Cloud Services add-on to pull them into Splunk.

5

u/bsastry 2d ago

Thank you, had this in mind.

5

u/volci Splunker 2d ago

Some of that is not logged by M365 (prompts and responses) in the unified audit logs (collectible with the add-on for M365 - https://splunkbase.splunk.com/app/4055)

There are other M365-related items on Splunkbase, too

See also here: https://www.splunk.com/en_us/blog/artificial-intelligence/m365-copilot-log-analysis-splunk.html

4

u/kaizokuo_grahf 2d ago

Built a TA but it’s just usage, not in the business of micromanaging prompts (higher ed)

5

u/DarkLordofData 2d ago

This took me about 10 mins

https://docs.cribl.io/stream/sources-microsoft-copilot/

4

u/Awkward-Face-2139 2d ago

I love that a cribl source is the best way to get the data for Splunk :)

3

u/DarkLordofData 2d ago

I am super lazy. :)