Splunk® Content Packs for ITSI and IT Essentials Work

Splunk Content Packs for ITSI and IT Essentials Work

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Troubleshoot the Content Pack for Microsoft Exchange

The Content Pack for Microsoft Exchange relies on the Splunk Add-on for Microsoft Exchange for input collection and knowledge management. When troubleshooting, determine whether the issue you are experiencing is relevant to the content pack or to the add-on.

Here are some common issues in Content Pack for Microsoft Exchange and how to resolve them.

The content pack is not working as expected

Problem

This problem applies to the Content Pack for Microsoft Exchange as included with the Splunk App for Content Packs. This problem does not apply to the content pack as installed using backup and restore functionality.

In some cases, the content pack might not work as expected. For example, you might open the Domain Alias Configuration - Microsoft Exchange dashboard from the Content Pack for Microsoft Exchange for the first time and see the domain aliases configured in the Splunk App for Microsoft Exchange, but not in the Content Pack for Microsoft Exchange.

Cause

Both the Content Pack for Microsoft Exchange and the Splunk App for Microsoft Exchange use the same knowledge objects with the same definitions. If you install both the app and the content pack on the same search head and perform different configurations, knowledge objects might conflict when storing or retrieving configurations.

Solution

You can't install the Splunk App for Microsoft Exchange and the Content Pack for Microsoft Exchange on the same search head. To learn how to correctly install the content pack and the app, see Install and configure the Content Pack for Microsoft Exchange.

"Invalid Data Model" errors in KPIs

Problem

KPIs show an "Invalid Data Model" error.

Cause

The knowledge objects, including macros and data models, can't be found because the sharing settings aren't set to Global. This error only occurs if you are using ITSI version 4.8.x or lower, or previous or IT Essentials Work version 1.1.0 or lower, and installed the content pack using backup and restore functionality.

Solution

Follow the steps to set the permissions for the knowledge objects and then re-install the content pack. For further details, see Install the content pack using backup and restore functionality provided by ITSI and IT Essentials Work.

Last modified on 22 October, 2021
PREVIOUS
Use the Content Pack for Microsoft Exchange
  NEXT
Dashboard reference for the Content Pack for Microsoft Exchange

This documentation applies to the following versions of Splunk® Content Packs for ITSI and IT Essentials Work: current


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters