Install and Configure the Splunk Add-on for Microsoft Exchange Indexes

Splunk Add-on for Microsoft Exchange Indexes contains the definition of the indexes. Install and configure the build to the indexer tier to create the Exchange-specific indexes in your environment.

Follow the instructions based on the type of your environment.

Install and Configure Splunk Add-on for Microsoft Exchange Indexes on an on-prem environment

If you have an indexer in an on-premise environment, follow the below steps on the indexer in order to install the package in your environment:

Deploy Splunk Add-on for Microsoft Exchange Indexes to indexer cluster deployment

1. Enable maintenance mode on the cluster master node.
2. Download the Splunk Add-on for Microsoft Exchange Indexes package from Splunkbase. and add the following packages to etc/master-apps
3. Push the configuration bundle from the cluster master node.
4. Disable the maintenance mode on the cluster master node.

Deploy Splunk Add-on for Microsoft Exchange Indexes to non clustered indexes deployment

1. Stop your Splunk indexer instance.
2. Download the Splunk Add-on for Microsoft Exchange Indexes package from Splunkbase.
3. Extract the package content to $SPLUNK_HOME/etc/apps on each indexer.
4. Start your Splunk indexer instance.

Install and Configure Splunk Add-on for Microsoft Exchange Indexes to the Cloud environment

1. Login to your Search Head.
2. On the Splunk Web home page, click the Find More Apps.
3. Search for the Splunk Add-on for Microsoft Exchange Indexes and click Install.
4. A confirmation box appears. Review and click Continue.
5. Enter your Splunk.com login credentials, read and accept the login disclaimer, and click Login and Download.
6. Go to Apps > Manage Apps to review the installed app on the Apps page.
7. Once the installation is complete, the indexes will be visible and searchable. No other steps are required for configuration.