Install a universal forwarder on each Exchange server

To get data from the Exchange servers into the Splunk App for Microsoft Exchange, you must install a Splunk universal forwarder onto each Exchange server in your environment, place the relevant technology add-ons into the forwarder, and configure the forwarders to send data to the central Splunk instance in the Splunk App for Microsoft Exchange deployment.

To install a universal forwarder onto each Exchange server, follow the steps located in one of these topics in the core Splunk documentation:

• "Deploy a Windows universal forwarder from the installer GUI"
• "Deploy a Windows universal forwarder from the command line"

Caution: Do not install a full Splunk instance on an Exchange server. Both full Splunk and Exchange have resource requirements that preclude installation of both services on one computer.

Once you've installed the universal forwarders, you can proceed to deploying the relevant Splunk App for Microsoft Exchange components to each one.

For more information about distributed deployments and how to deploy universal forwarders, read "Universal forwarder deployment overview" in the core Splunk documentation.