Splunk® App for Microsoft Exchange

Deploy and Use the Splunk App for Microsoft Exchange

Download manual as PDF

This documentation does not apply to the most recent version of MSExchange. Click here for the latest version.
Download topic as PDF

Deploy configurations for all server roles

This procedure describes using the Splunk deployment server to deploy the Splunk App for Microsoft Exchange configurations to Splunk universal forwarders already installed on each of the Exchange server systems in your environment. Before you proceed, make sure you have followed the instructions in "Install a universal forwarder on each Exchange server".

You do not have to use deployment server to deploy the Splunk App for Microsoft Exchange--you can copy the appropriate components to the forwarders and search heads by hand if you like. A benefit to using deployment server is that you can update the components very easily when a new version of the app becomes available.

You can configure your central Splunk instance to be a deployment server, or install full Splunk on another server and configure it as the deployment server.

Caution: The Splunk App for Microsoft Exchange puts all the data it indexes into three indexes, msexchange, perfmon, and blackberry. If you don't want to use these indexes for the data, you must change the app's configuration as described in "Other deployment considerations" and "Make configuration changes to match your existing environment" in this manual, before you deploy it to the forwarders.

Prepare the deployment on the deployment server

To configure your deployment server:

1. Edit %SPLUNK_HOME%\etc\system\local\serverclass.conf on your deployment server to specify a server class for each server role and Windows Server version and optionally one for the server running the reputation service (which must have Internet access). The recommended naming convention is:

  • Exchange-<version>-<role>
  • Exchange-Windows-<version>
  • Exchange-Reputation

Note: There is an example serverclass.conf located in %SPLUNK_HOME%\etc\apps\Splunk_for_Exchange\appserver\addons. You can copy this file to %SPLUNK_HOME%\etc\apps\Splunk_for_Exchange\local and edit it to suit your needs.

2. Make sure that you have made all necessary edits to the technology add-ons (TAs) you want to deploy into %SPLUNK_HOME%\etc\deployment-apps as described in "Make configuration changes to match your existing environment".

3. In %SPLUNK_HOME%\etc\system\local\serverclass.conf ensure that the components you want to deploy are configured to be pushed to the right machines:

  • Each universal forwarder gets the appropriate TAs for the Exchange Server roles running on that system.
  • Indexers get all of the TAs.
  • Search heads get the app and all of the TAs.

Push the components to their respective locations

Once you've completed all desired configuration changes, push the prepared components to their respective locations in your infrastructure:

1. On the deployment server, run the following command to reload the deployment server and update the various Splunk instances:

%SPLUNK_HOME%\bin\splunk reload deploy-server

2. After a few minutes, check that the deployment was pushed correctly with the following command:

%SPLUNK_HOME%\bin\splunk list deploy-clients

3. Wait 10 minutes, then follow the instructions in "Log in and get started" in this manual to view the Splunk App for Microsoft Exchange overview dashboard and confirm that data is coming into the app.

Make configuration changes to match your existing environment
Additional tasks for the Exchange server roles

This documentation applies to the following versions of Splunk® App for Microsoft Exchange: 1.1, 1.1.1, 1.1.4, 1.1.5, 1.1.6

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters