Install the Splunk App for Microsoft Exchange on the search head

The Splunk App for Microsoft Exchange lets you view all of the data that you have collected during the setup process. This topic discusses installing the app as well as some required add-ons (described in detail) that complete the process and allow you to use the app.

Final setup phase

If you have followed the instructions in this manual, then by completing the procedures in this topic, you will complete the setup phase for the app.

The final tasks for setup are:

• Install the Splunk Add-on for Windows on the search head.
• Install the Splunk Supporting Add-on for Active Directory on the search head.
• Install the Splunk App for Microsoft Exchange on the search head.

In this procedure, you will install all of these components on the same server you installed in the basic infrastructure setup.

Where is the search head?

In this manual, the search head is the indexer that you first set up. All Splunk Enterprise instances have an inherent capability of being a search head when they hold indexed data.

When you scale the Splunk App for Microsoft Exchange, the search head is on a separate host from the indexer. See Size a Splunk App for Microsoft Exchange deployment.

Install the Splunk Add-on for Windows

As part of getting Windows data into the instance, you have already installed the Splunk Add-on for Windows. To activate the Splunk Add-on for Windows for the Splunk App for Microsoft Exchange, copy the add-on from either the location where you saved the download or the deployment apps directory to the Splunk apps directory:

> Copy-Item -Path C:\Program Files\Splunk\etc\deployment-apps\Splunk_TA_windows -Destination C:\Program Files\Splunk\etc\apps -Recurse -Force

Install the Splunk Supporting Add-on for Active Directory (SA-ldapsearch)

Next, install the Splunk Supporting Add-on for Active Directory in the Splunk apps directory:

1. In a web browser, proceed to the Splunk Supporting Add-on for Active Directory download page.

2. Click the download link to begin the download process.

• Make sure you download the latest version of the add-on.
• You might need to sign in with your Splunk account before the download starts.

3. When prompted, choose an accessible location on your deployment server to save the download. Do not attempt to run the download.

4. Use an archive utility such as WinZip or tar to unarchive the file to the Splunk apps directory.

Install the Splunk App for Microsoft Exchange

The final piece of software to install is the Splunk App for Microsoft Exchange itself.

As part of getting Active Directory data into the instance, you have already downloaded the Splunk App for Microsoft Exchange. To activate the app:

1. Copy it from the location you saved the download previously to the Splunk apps directory:

> Copy-Item -Path C:\Downloads\splunk_app_microsoft_exchange -Destination C:\Program Files\Splunk\etc\apps -Recurse -Force

2. Restart Splunk Enterprise on each machine in the instance.

3. Log back in to Splunk Enterprise.

Add the exchange_admin role to the user that will run the app on the deployer

The exchange_admin role is required to run the first-time setup on the search head cluster deployer instance.

1. Log into Splunk Enterprise on the deployer.
2. Navigate to Settings > Access controls and click on Roles.
3. Under Role name, select the admin role.
4. Navigate to the Inheritance section and select the exchange_admin role to move it from Selected roles to Available roles.
5. Click Save.

Note: If you do not see the exchange_admin role in the list, make sure that you have installed the application, as described in "Install the Splunk App for Microsoft Exchange on the deployer".

What's next?

You have completed setup of the Splunk App for Microsoft Exchange.

Now, you can log into Splunk Enterprise and complete the first-time setup experience.