Troubleshoot the Splunk App for Microsoft Exchange

Is the Splunk App for Microsoft Exchange deployment correctly configured?

The first thing to check when Splunk App for Microsoft Exchange data is incomplete or incorrect is to confirm that the central Splunk instance is properly configured and receives data.

1. Confirm that every indexer in the deployment has been configured to receive data. See Install and configure a Splunk Enterprise indexer for instructions.
2. Confirm that every search head in the deployment has been configured to search all indexers. Search heads must search all available indexers to get all indexed data. See Configure distributed search in Distributed Search for specific instructions on configuring search heads and search peers (indexers).
3. Confirm that you have installed and configured all of the pieces properly. Indexes that the Splunk App for Microsoft Exchange requires must be present on all indexers.
   
   • msexchange for Exchange events.
   • msad: for AD health metrics.
   • winevents: for Directory Service, Replication Service, DNS server event logs.
   • perfmon: for performance metrics.
4. Confirm that the Splunk App for Microsoft Exchange resides on all indexers and search heads in the deployment.
5. Confirm that the Splunk Supporting Add-on for Active Directory (SA-ldapsearch) has been configured properly. See Configure the Splunk Supporting Add-on for Active Directory.
6. Confirm that the Splunk Supporting Add-on for Active Directory resides on all search heads in the deployment. See "Troubleshoot issues with SA-LDAPsearch."
7. Confirm that eventtypes.conf (in %SPLUNK_HOME%\etc\apps\splunk_app_microsoft_exchange\local) has been configured with the proper indexes for the defined event types. Check for typos in the configuration file.
8. Confirm that the Splunk App for Microsoft Exchange lookup tables have been properly created. From the "Tools and Settings" menu, select "Build lookups".
9. Confirm that PowerShell is available on all domain controllers and DNS Server hosts. See Configure PowerShell execution in Active Directory.
10. Confirm that Group Policy objects to change audit policy are in place to enable local script execution. See "Configure Active Directory Audit Policy."

Troubleshoot issues with SA-LDAPsearch

To troubleshoot problems with the Splunk App for Microsoft Exchange and the Splunk Supporting Add-on for Active Directory version 2.0.1, see Troubleshoot the Splunk Supporting Add-on for Active Directory in the Splunk Supporting Add-on for Active Directory documentation.

To troubleshoot problems with version 2.1, see Troubleshoot the Splunk Supporting Add-on for Active Directory for version 2.1.

Windows event log or performance events from universal forwarders go to the 'main' index

When you install a universal forwarder on your Exchange server, do not select any options in the Enable Inputs screen of the installer. Doing so enables the scripted inputs that come with the forwarder by default. Those inputs send data to the "default" index as specified in their configuration files, which, on a standard Splunk Enterprise installation, is main.

After you install the universal forwarder onto your exchange server, deploy the appropriate add-ons for Windows, Active Directory, Windows DNS, or Exchange to ensure that the data those add-ons collect goes to the correct index.

No data types found after upgrade

If you experience a problem where the first-time run process detects no data after an upgrade, make sure that you add the exchange-admin role to the user that runs the app.

1. From Splunk Web, click Settings.
2. In the window that pops up, under "Users and Authentication", click Access Controls. Splunk Enterprise loads the "Access Controls" page.
3. Click Users. Splunk Enterprise loads the "Users" page.
4. In the Username column, click the name of the user that runs the Splunk App for Microsoft Exchange. Splunk Enterprise loads the settings page for that user.
5. Scroll down to Assign to roles.
6. Add the exchange-admin role to the Selected roles pane by clicking on its entry in the Available roles pane.
7. Click Save. Splunk Enterprise saves the changes and returns you to the Users page.

Dashboards do not populate due to errors with PowerShell modules

If you run Exchange Server 2010 with Service Pack 2, you might experience an issue where dashboards do not populate because of errors with PowerShell. This owes to a bug that occurs when you apply Exchange Server 2010 SP2. This is a problem with Exchange Server and not with the Splunk software.

To fix the problem, follow the instructions at "Microsoft.Exchange.Management.PowerShell.E2010 is not installed on this machine" on MS TechNet Blogs.

Dashboards fail to load after upgrading the app or Splunk Enterprise

If you experience a problem where some dashboard panels or menus fail to load after you upgrade either Splunk Enterprise or the Splunk App for Microsoft Exchange, clear your web browser cache, log out of Splunk Enterprise, then log back in.

The Service Analyzer page displays errors after an upgrade

If you experience errors in the Service Analyzer after upgrading the Splunk App for Microsoft Exchange, confirm that the new data model has built successfully.

Check data model build progress

To check the status of the new Microsoft Exchange data model, follow this procedure:

1. Log into Splunk Enterprise on a search head in the deployment.
2. In the system bar, click Settings > Data Model. Splunk Enterprise loads the "Data Models" page.
3. In the entry for Microsoft Exchange click the caret to the left of the title.
4. Review the status under Acceleration. The status says "100% complete" when it has finished. Otherwise, it says "Building."
5. Wait until the status says "100% complete" before using the app. After an upgrade, this process could take a while.