Install the central Splunk for Microsoft Exchange app instance

The central component of a Splunk App for Microsoft Exchange deployment is the Splunk indexer (and, optionally, any additional indexers and/or search heads that send search requests). You install the following components on the central instance:

• If your central Splunk instance is a single Splunk installation with both the indexer and Splunk Web running on the same instance, install the entire contents of the app onto that instance.

• If your central Splunk instance is distributed (meaning that it contains indexer(s) and search head(s) on separate systems):
  • You must create the appropriate indexes (perfmon, msexchange, blackberry) on every indexer in the instance.
  • You must install the main Splunk App for Microsoft Exchange package onto every search head in the instance.

Before installing the Splunk App for Microsoft Exchange onto your central Splunk instance, make sure that you have provisioned the instance to support the level of indexing and interaction that you anticipate for your deployment. For more information on this, review:

• "Platform and hardware requirements"
• "Other deployment considerations"

Install Splunk

If you're not using an existing Splunk installation, download the full Splunk package for your platform, and follow the installation instructions in the core Splunk documentation.

Install the Supporting Add-on for Active Directory (SA-ldapsearch)

Download and install the Supporting Add-on for Active Directory.

Install the central instance of Splunk App for Microsoft Exchange

This procedure assumes you have already installed Splunk on the host you intend to use as the indexer for your Exchange data.

1. Download the Splunk App for Microsoft Exchange from Splunkbase.

2. Install the Splunk_for_Exchange-vX.XX.tgz file into your Splunk instance.

Note: You can install the app by going into the Apps screen in Manager and clicking the Install app from file button. You can also unpack the installation package directly into %SPLUNK_HOME%\etc\apps on the server.

3. Restart Splunk.

4. Log back in to Splunk.

Configure the central instance of Splunk App for Microsoft Exchange

Once you have installed the Splunk App for Microsoft Exchange on the central Splunk instance, you must configure the instance so that it collects all of the relevant Exchange data you want to monitor.

Configure NetBIOS to DNS domain name translation

To make sure that the Splunk App for Microsoft Exchange monitors all connections into Exchange properly, you must edit the NetBIOS-to-DNS domain name alias file. This file is located at %SPLUNK_HOME%\etc\apps\Splunk_for_Exchange\local\domain_aliases.csv.

Create and/or edit this file to add aliases for your NetBIOS domain names to your DNS-based domain names.

You must create this file if it does not exist. The file must contain entries similar to the following:

	UNKNOWN,spl.com
	SPL,spl.com

Each line consists of two comma-separated strings. The first string is the NetBIOS name that you want to translate, and the second string is the DNS domain name that you want to translate the NetBIOS name to. In the example above:

SPL,spl.com means "Treat connections from the NetBIOS domain SPL as if they came from the DNS domain spl.com.

Important: When editing this file, make sure to always retain the UNKNOWN entry, as any unqualified user names will be set to UNKNOWN.

Configure logon name normalization lookups

You can also tell the Splunk App for Microsoft Exchange to translate logon usernames to normalized logon names. To do so, create and/or edit %SPLUNK_HOME%\etc\apps\Splunk_for_Exchange\local\active_directory.csv.

You must create this file if it does not exist.

Each line in active_directory.csv contains three comma-separated strings. For example:

	spl.com,jdoe,john.doe

The above example says "translate john.doe to jdoe@spl.com".

You can have any number of lines in this file. The contents of the file vary depending on how your users log into Exchange - whether it's through Outlook Web Access, Exchange Web Services or some other web-based mail agent. You can generate a list from Active Directory, if needed.

Configure base searches and indexes used to gather data

Before starting the Splunk App for Microsoft Exchange, review %SPLUNK_HOME%\etc\apps\Splunk_for_Exchange\default\eventtypes.conf to make sure that all of the app's base searches are using the correct indexes.

If you need to make changes to this file, copy it to %SPLUNK_HOME%\etc\apps\Splunk_for_Exchange\local before making the changes.

Configure display options and searches that gather data

Finally, review %SPLUNK_HOME%\etc\apps\Splunk_for_Exchange\default\macros.conf to ensure that the app properly uses the defined searches to gather data from your Exchange servers. You will also need to review this file to ensure that the Messages Per Hour gauge on the front page of the app displays appropriate values for your organization.

Configure Splunk to receive the data from the forwarders on your Exchange servers

You can enable receiving on a Splunk instance through Splunk Web or the CLI.

Important: By default, the Splunk App for Microsoft Exchange configures your instance of Splunk to receive data over TCP port 9997. If you need this to be a different port, you can change this value. You will also need to change it in a copy of the outputs.conf files on the universal forwarders installed on your Exchange servers.

Set up receiving with Splunk Web

Use Splunk Manager or Settings to set up a receiver:

1. Log into Splunk Web as admin on the server that will be receiving data from a forwarder.

2. Click Manager in the upper right corner.

3. Select Forwarding and receiving in the Data area.

4. Click Add new in the Receive data section.

5. Specify which TCP port you want the receiver to listen on (the listening port). For example, if you enter "9997," the receiver will receive data on port 9997. By convention, receivers listen on port 9997, but you can specify any unused port. You can use a tool like netstat to determine what ports are available on your system. Make sure the port you select is not in use by splunkweb or splunkd.

6. Click Save.

Note: You must restart Splunk to complete the process.

Set up receiving with the Splunk CLI

To access the CLI, first navigate to $SPLUNK_HOME\bin\. This is unnecessary if you have added Splunk to your path.

To enable receiving, enter:

./splunk enable listen <port> -auth <username>:<password>

Splunk prompts you for your Splunk username (by default, admin) and password.

For <port>, substitute the port you want the receiver to listen on (the listening port). For example, if you enter "9997," the receiver will receive data on port 9997. By default, receivers listen on port 9997, but you can specify any unused TCP port. You can use a tool like netstat to determine what ports are available on your system. Make sure the port you select is not in use by splunkweb or splunkd.

To disable receiving, enter:

./splunk disable listen -port <port> -auth <username>:<password>

Splunk prompts you for your Splunk username (by default, admin) and password.

• Read "Set up forwarding and receiving" in the core Splunk product documentation for an introduction to forwarding and receiving.
• Read "Configure forwarders with outputs.conf" in the core Splunk documentation for information about outputs.conf.