Splunk® Supported Add-ons

Splunk Add-on for Microsoft Exchange

TA-Exchange-Mailbox inputs

The TA-Exchange-Mailbox add-on collects performance and Windows host monitoring data from Windows hosts that run Exchange Server and hold the Mailbox Store role. See Configure TA-Exchange-Mailbox to learn how to configure the add-on for your version of Exchange Server prior to deploying it to Exchange Server hosts.

The add-on includes the following data inputs:

Common data inputs

[WinHostMon://Processes]
[WinHostMon://Services]
[perfmon://Total_Processor_Time]
[perfmon://Processor]
[perfmon://System]
[perfmon://Available_Memory]
[perfmon://Memory]
[perfmon://DotNET_CLR_Memory]
[perfmon://Network_Utilization]
[perfmon://TCPv4]
[perfmon://TCPv6]
[perfmon://MSExchange_Search_Indices]
[perfmon://MSExchange_Control_Panel]
[perfmon://Process_Microsoft.Exchange.Search.ExSearch]
[perfmon://Process_MSExchangeMailboxAssistants]
[perfmon://Process_msftesq]
[perfmon://MSExchange_Assistants_Per_Assistant]
[perfmon://MSExchange_Assistants_Per_DB]
[perfmon://MSExchange_Store_Interface_Total]
[perfmon://MSExchange_Store_Interface]
[perfmon://MSExchange_Mail_Submission]
[perfmon://MSExchange_ADAccess_Processes]
[perfmon://LogicalDisk]
[perfmon://MSExchangeIS]
[perfmon://MSExchange_Database_Edge_Transport]
[perfmon://MSExchange_Database_NoInstances]
[perfmon://MSExchange_Resourcebooking]
[perfmon://MSExchange_IS_Public]
[perfmon://MSExchange_Replication]
[perfmon://MSExchange_Calendarattendant]
[perfmon://MSExchange_IS_Mailbox]

Exchange Server 2010 data inputs (Not supported)

[perfmon://MSExchangeIS_Mailbox_2010]
[perfmon://MSExchange_Database_2010]
[perfmon://MSExchange_Database_Instances_2010]
[perfmon://MSExchangeIS_Client_2010]
[perfmon://MRM_Assistants_2010]
[perfmon://MSExchange_ADAccess_Caching_2010]
[perfmon://MRM_Counters_2010]
[perfmon://MSExchange_ADAccess_DC_2010]
[script://.\bin\exchangepowershell.cmd v14 get-publicfolderstats_2010.ps1]
[script://.\bin\exchangepowershell.cmd v14 get-databasestats_2010.ps1]
[script://.\bin\exchangepowershell.cmd v14 get-folderstats_2010.ps1]
[script://.\bin\exchangepowershell.cmd v14 get-distlists_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v14 get-hoststats_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v14 read-audit-logs_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v14 read-mailbox-audit-logs_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v14 get-mailboxstats_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v14 get-inboxrules_2010_2013.ps1]

Exchange Server 2013, 2016, and 2019 data inputs

[perfmon://OWA]
[perfmon://ActiveSync]
[perfmon://MSExchangePop3]
[perfmon://MSExchangeImap4]
[perfmon://Disk]
[perfmon://MSExchangeIS_Store]
[perfmon://MSExchange_Queue_Lengths]
[perfmon://MSExchange_Transport_Dumpster]
[perfmon://MSExchange_Store_Driver]
[perfmon://MSExchange_SmtpReceive]
[perfmon://MSExchange_SmtpSend]
[perfmon://MSExchange_Extensibility_Agents]
[perfmon://MSExchangeIS_Client_2013]
[perfmon://MSExchange_ADAccess_Caching_2013]
[perfmon://MRM_Counters_2013]
[perfmon://MSExchange_Database_2013]
[perfmon://MSExchange_Database_Instances_2013]
[perfmon://MSExchange_ADAccess_DC_2013]
[perfmon://MRM_Assistants_2013]
[monitor://C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking]
[script://.\bin\exchangepowershell.cmd v15 get-databasestats_2013.ps1]
[script://.\bin\exchangepowershell.cmd v15 get-folderstats_2013.ps1]
[script://.\bin\exchangepowershell.cmd v15 get-distlists_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v15 get-hoststats_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v15 get-mailboxstats_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v15 get-inboxrules_2010_2013.ps1]
[script://.\bin\exchangepowershell_mailbox2016.cmd v15 read-audit-logs_2016.ps1]
[script://.\bin\exchangepowershell_mailbox2016.cmd v15 read-mailbox-audit-logs_2016.ps1]

For the admin audit log data collection, the PowerShell script saves the checkpoint (date) when this data was previously collected. Saving this checkpoint creates and uses splunk-msexchange-auditfile.clixml and splunk-msexchange-mailboxauditlogs.clixml, which uses %TEMP% as a location and C:\Windows\Temp as a path for the user account that SplunkForwarder services is running.

Last modified on 16 July, 2024
Overview of TA-Exchange-Mailbox   Configure TA-Exchange-Mailbox

This documentation applies to the following versions of Splunk® Supported Add-ons: released, released


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters