Install the add-ons into universal forwarders

You can install the add-ons needed for the Splunk App for Microsoft Exchange manually, or by using a deployment server.

Where to install the add-ons

The table below shows you where the add-ons for the Splunk App for Microsoft Exchange should be installed. These add-ons come with the Splunk App for Microsoft Exchange installation package.

Exchange-specific add-ons

If the Exchange server runs:	and it holds this Exchange role:	then install or deploy these add-on(s):
Exchange 2007	Client Access Server	TA-Exchange-2007-CAS TA-Windows-2003-Exchange-IIS The Splunk Add-on for Windows Splunk_TA_Windows
	Edge Transport	TA-Exchange-2007-HubTransport Splunk_TA_Windows
	Hub Transport	TA-Exchange-2007-HubTransport Splunk_TA_Windows
	Mailbox Server	TA-Exchange-2007-MailboxStore Splunk_TA_Windows
Exchange 2010	Client Access Server	TA-Exchange-2010-CAS TA-Windows-2008R2-Exchange-IIS Splunk_TA_Windows
	Edge Transport	TA-Exchange-2010-HubTransport Splunk_TA_Windows
	Hub Transport	TA-Exchange-2010-HubTransport Splunk_TA_Windows
	Mailbox Server	TA-Exchange-2010-MailboxStore Splunk_TA_Windows
Exchange 2013	Client Access Server	TA-Exchange-2013-ClientAccess TA-Windows-2012-Exchange-IIS Splunk_TA_Windows
	Mailbox Server	TA-Exchange-2013-Mailbox Splunk_TA_Windows

Active Directory and Windows add-ons

Install the Active Directory and Windows add-ons onto your AD and Windows servers according to this table:

If the server:	and it runs:	then install or deploy:
does not have an Active Directory role	any supported version of Windows Server	Splunk_TA_Windows
is a domain controller	Windows Server 2003 or Server 2003 R2	Splunk_TA_Windows TA-DomainController-NT5
	Windows Server 2008, Server 2008 R2, Server 2008 R2 Core, or Server 2012	Splunk_TA_Windows TA-DomainController-NT6
	Windows Server 2012 R2	Splunk_TA_Windows TA-DomainController-2012r2 SA-ModularInput-PowerShell
is a DNS server	Windows Server 2003 or Server 2003 R2	Splunk_TA_Windows TA-DNSServer-NT5
	Windows Server 2008, Server 2008 R2, Server 2008 R2 Core, Server 2012, or Server 2012 R2	Splunk_TA_Windows TA-DNSServer-NT6
is a domain controller and a DNS server	Windows Server 2003 or Server 2003 R2	Splunk_TA_Windows TA-DomainController-NT5 TA-DNSServer-NT5
	Windows Server 2008, Server 2008 R2, Server 2008 R2 Core, or Server 2012	Splunk_TA_Windows TA-DomainController-NT6 TA-DNSServer-NT6
	Windows Server 2012 R2	Splunk_TA_Windows TA-DomainController-2012r2 TA-DNSServer-NT6 SA-ModularInput-PowerShell

How to deploy the add-ons into the universal forwarders

To install the add-ons into the universal forwarders, you must place the add-on folders into %SPLUNK_HOME%\etc\apps on each forwarder. You can do this manually with operating system tools, or with a Splunk deployment server.

• If you have a deployment server and want to use it to deploy the app, then:

1. Copy the add-on folders from the Splunk App for Microsoft Exchange installation package into %SPLUNK_HOME%\etc\deployment-apps on the deployment server.

2. Configure server classes on the deployment server to deploy the add-on(s) to the correct server(s).

• If you do not have a deployment server, or do not want to use one to deploy the app, then you must:

1. Review the tables above to determine which servers the add-ons should go on.

2. Manually copy the add-on(s) from the Splunk App for Microsoft Exchange installation package to %SPLUNK_HOME%\etc\apps on every Exchange, Windows, and/or Active Directory server from which you want to get Exchange and Windows logs.