Splunk® App for Microsoft Exchange (EOL)

Deploy and Use the Splunk App for Microsoft Exchange

Acrobat logo Download manual as PDF


On October 22 2021, the Splunk App for Microsoft Exchange will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for Microsoft Exchange.
This documentation does not apply to the most recent version of Splunk® App for Microsoft Exchange (EOL). For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

What data the Splunk App for Microsoft Exchange collects

The Splunk App for Microsoft Exchange's associated add-ons collect data from your Exchange servers. They then send the data to an index, which the app uses in its dashboards, charts, and reports. This topic discusses the specifics of the data that the app collects and displays.

The Splunk App for Microsoft Exchange collects the following data using file inputs:

  • Internet Information Server (IIS) logs for the Exchange servers whose designated roles require IIS
  • Performance monitoring data.
  • Active Directory logs (via the Splunk Add-on for Windows and the Active Directory add-ons included with the Splunk App for Microsoft Exchange.)
  • Windows network, host, and printer monitoring information (via the Splunk Add-on for Windows.)
  • Windows Event logs (via the Splunk Add-on for Windows):
    • Security Logs
    • Exchange audit logs
    • Application logs, such as Forefront Protection Services (FPS) security logs

The Splunk App for Microsoft Exchange collects the following data using scripted inputs:

  • Senderbase/reputation data. This feature needs internet access to function, as it looks up the reputation score for your email users.
  • Topology and Health information
  • Mailbox Server health and usage information

Important: The Splunk App for Microsoft Exchange puts the data it indexes into several indexes:

  • The Exchange, IIS, and application logs get indexed into the msexchange index.
  • The performance monitor logs get indexed into the perfmon index.


Where and how the Splunk App for Microsoft Exchange expects to find your logs

The Splunk App for Microsoft Exchange assumes that all your Exchange servers send log data to their default locations. If this is not true, then you must configure the relevant add-ons to tell the Splunk App for Microsoft Exchange to look in the right place for your Exchange, Windows, and Active Directory data.

To make edits to add-ons within the Splunk App for Microsoft Exchange directory store:

1. Using Explorer, a command prompt, or a PowerShell instance, navigate to %SPLUNK_HOME%\etc\apps\splunk_app_microsoft_exchange\appserver\addons.

2. Find the add-on that you want to edit:

  • If you are using a deployment server, you can locate the add-on in %SPLUNK_HOME%\etc\deployment-apps\<Addon-Name> on the deployment server.
  • If you are not using a deployment server, you can locate the add-on in %SPLUNK_HOME%\etc\apps\splunk_app_microsoft_exchange\appserver\addons\<Addon-Name> on the universal forwarder.

3. In the relevant add-on directory, make a copy of default\inputs.conf and place it in local\.

Note: If you've already deployed the app, make a copy of %SPLUNK_HOME%\etc\apps\splunk_app_microsoft_exchange\appserver\addons\<Addon-Name>\default\inputs.conf and put it in %SPLUNK_HOME%\etc\apps\splunk_app_microsoft_exchange\appserver\addons\<Addon-Name>\local\.

4. Edit the inputs.conf you copied to %SPLUNK_HOME%\etc\apps\splunk_app_microsoft_exchange\appserver\addons\<Addon-Name>\local and change the file paths for the relevant input stanzas to the desired locations.

5. Save the file.

6. If you have already deployed, restart the Splunk forwarder.

Log format

The Splunk App for Microsoft Exchange also assumes you haven't changed the format of the logs. If you have changed the log format in any way then you must configure both the app on the central Splunk instance and the relevant TA-Windows-2003-Exchange-IIS add-on on the servers that produce the logs to tell the Splunk App for Microsoft Exchange how to process those logs.

To reconfigure the add-on to understand the changed log format:

1. In the %SPLUNK_HOME%\etc\apps\splunk_app_microsoft_exchange\appserver\addons\TA-Windows-2003-Exchange-IIS directory, make a copy of default\inputs.conf.

2. Put this file in local\.

Note: If you've already deployed the app, make a copy of %SPLUNK_HOME%\etc\apps\splunk_app_microsoft_exchange\appserver\addons\TA-Windows-2003-Exchange-IIS\default\transforms.conf and put it in %SPLUNK_HOME%\etc\apps\splunk_app_microsoft_exchange\appserver\addons\TA-Windows-2003-Exchange-IIS\local\.

3. Edit the local\transforms.conf file to modify the field extractions to match the log format you use.

  • In the TA-Windows-2003-Exchange-IIS add-on, the [mswin_2003_iis_fields] stanza defines the field extractions.
  • In the TA-Windows-2008R2-Exchange-IIS add-on, the [mswin_2008r2_iis_fields] stanza defines the field extractions.

Note: Refer to "Create and maintain search-time field extractions through configuration files" in the core Splunk Enterprise documentation for information on how to edit transforms.conf.

4. Save the file.

5. If you have already deployed, restart the Splunk forwarder.

To configure the Splunk App for Microsoft Exchange to understand the changed log format:

1. In the %SPLUNK_HOME%\etc\apps\splunk_app_microsoft_exchange directory, make a copy of default\inputs.conf.

2. Put this file in local\.

Note: If you've already deployed the app, make a copy of %SPLUNK_HOME%\etc\apps\splunk_app_microsoft_exchange\default\transforms.conf and put it in %SPLUNK_HOME%\etc\apps\splunk_app_microsoft_exchange\local\.

3. Edit the local\transforms.conf to modify the field extractions to match the log format you're using.

Note: Refer to "Create and maintain search-time field extractions through configuration files" in the core Splunk product documentation for information on how to edit transforms.conf.

4. Save the file.

5. If you have already deployed, restart all servers in the central Splunk instance.

Last modified on 12 February, 2014
PREVIOUS
Platform and hardware requirements
  NEXT
Other deployment considerations

This documentation applies to the following versions of Splunk® App for Microsoft Exchange (EOL): 3.0, 3.0.1, 3.0.2, 3.0.3


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters