Install a universal forwarder on each Exchange server

To get data from the Exchange servers into the Splunk App for Microsoft Exchange, you must install a Splunk universal forwarder onto each Exchange server in your environment, place the appropriate Splunk App for Microsoft Exchange add-ons into the forwarder, and configure the forwarders to send data to the central Splunk App for Microsoft Exchange instance.

You must also perform the same steps to get data from the Active Directory and Windows servers in your network. The only differences are the add-ons you install.

To install a universal forwarder onto each server, follow the steps located in one of these topics in the core Splunk Enterprise documentation:

• "Deploy a Windows universal forwarder from the installer GUI" or
• "Deploy a Windows universal forwarder from the command line"

Caution: Do not install a full Splunk instance on an Exchange server. Both full Splunk and Exchange have resource requirements that preclude installation of both services on one computer.

Once you've installed the universal forwarders, you can proceed to deploying the appropriate Splunk App for Microsoft Exchange add-ons to each one.

For more information about distributed deployments and how to deploy universal forwarders, read "Universal forwarder deployment overview" in the core Splunk Enterprise documentation.