How to deploy the Splunk App for Microsoft Exchange

To install the app, complete the following sections in sequence:

• Set up basic infrastructure
• Get Windows data in
• Get Active Directory data in
• Get Domain Name Service (DNS) data in
• Get Exchange Data in
• Complete setup
• Run the guided setup experience

If you're using TA-Windows v6.0.0, you don't need TA_AD and TA_DNS. TA_AD and TA_DNS are merged with TA-Windows v6.0.0.

What if I know how to install Splunk Enterprise and Splunk apps?

If you already have indexers, search heads, forwarders, and a deployment server set up, then you can skip most of the basic infrastructure setup chapter. If you have experience installing Splunk Enterprise, then perform the installation methods you are comfortable with. It is still a good idea to review the new procedure to get an understanding of how the components work together.

The process is as follows:

• Set up indexer(s) to receive data.
• Configure universal forwarders to forward data to the indexers.
• Follow the "Getting Data In" topics to get the required data into the indexers.
• Follow the "Complete Setup" topics to set up the app on search heads.
• Run the guided setup experience to check for data presence and correct any problems.

Where to install components

The table below lists what components to install and where to install them.

Recommended Splunk App for Microsoft Exchange Component Installation Locations

	Search Head	Indexer	Univ. Fwder.	Heavy Fwder.	Deploy. Serv.
Splunk App for Microsoft Exchange	X
Splunk Add-on for Windows1	X	X	X	X	XW
"Send to indexer" app2			X
Splunk Add-on for Microsoft Active Directory			X
Splunk Add-on for Windows DNS	X	X	X
Splunk Supporting Add-on for Active Dir.	X

Recommended Splunk Add-on for Microsoft Exchange Component Installation Locations

	Search Head	Indexer	Univ. Fwder.	Heavy Fwder.	Deploy. Serv.
SA-ExchangeIndex		X
TA-Exchange-ClientAccess			X
TA-Exchange-HubTransport			X
TA-Exchange-Mailbox			X
TA-Windows-Exchange-IIS			X
TA-SMTP-Reputation				X3

1. You must configure this add-on before you install or deploy it.
2. You only require this app when you use a deployment server and want to control all forwarding configurations from there.
3. This computer must have an outbound connection to the Internet.

W. Only if this host runs Windows and you want to monitor it with the app.

If you're using TA-Windows v6.0.0, you don't need TA_AD and TA_DNS. TA_AD and TA_DNS are merged with TA-Windows v6.0.0.

Set up basic infrastructure

This chapter sets up the basic building blocks for the environment.

1. Install and configure a Splunk indexer.
2. Create the "send to indexer" app. This app configures forwarding on hosts that send data to the indexer.
3. Set up a deployment server to manage the "send to indexer" and other apps.
4. Install a universal forwarder on each Windows host and tell them to contact the deployment server for configuration and app downloads.
5. As each universal forwarder connects, add them to a base "universal forwarder" server class to turn them into deployment clients.

Once you complete this chapter, you have the basic framework for a deployment.

Get Data In

The next chapters take you through configuring the apps and add-ons that the Splunk App for Microsoft Exchange needs and deploying them to the right deployment clients. At the end of each chapter, you can confirm that data is present on the indexer by running some sample search commands.

1. The "Get Windows data" chapter discusses getting Windows data into the indexer. Complete it to install the Splunk Add-on for Windows on every Windows machine in the environment.
2. The "Get Active Directory data" chapter details configuring Active Directory and getting AD data into the indexer. Complete the instructions in this chapter to install the Splunk Add-ons for Active Directory on Active Directory hosts in the environment.
3. The "Get Domain Name Services (DNS) data" chapter provides instructions on how to get Windows DNS data into the service. Perform the procedures in this chapter to deploy the Splunk Add-ons for Windows DNS on DNS hosts and get DNS data.
4. The "Get Exchange data" chapter completes the data consumption phase of setup. Finish the steps within to install the Splunk Add-ons for Microsoft Exchange and get in Exchange data.

If you're using TA-Windows v6.0.0, you don't need TA_AD and TA_DNS. TA_AD and TA_DNS are merged with TA-Windows v6.0.0.

Complete setup

After getting data in and confirming that it is there, complete setup.

1. Install the app and some add-ons onto the central instance.
2. Install an app license.

The Splunk App for Microsoft Exchange comes with a 60-day trial license. The app will cease to function if it cannot find this license, or it expires. This license is a separate license, in addition to any license(s) you have for Splunk Enterprise. See the topic for additional information on how to get a license.

Run the guided setup experience

After you add a license, activate the app.

1. Log into the search head.
2. Select the app to start the guided setup experience. See Configure the Splunk App for Microsoft Exchange.
3. Follow the prompts to confirm prerequisites, locate minimum data requirements, and configure aliases. You might need to go to other apps like the Splunk Supporting App for Active Directory to add or change configurations.
4. Wait as the app searches for your data, builds lookups and data models, and enables features and pages.
5. After setup completes, the app is ready for use.
6. (Optional) See the Splunk App for Microsoft Exchange Reference manual to learn about the new pages that come with the app, and how to use all of the app dashboards.