MSExchange Messaging data model

The Splunk App for Microsoft Exchange comes with data models that facilitate and improve the efficiency of searches within the app.

The fields and tags in the MSExchange_Messaging data model describe various aspects of Microsoft Exchange operation, such as message tracking, message volume, and number of messages per second.

This data model is designed to improve the performance of the following panels of the Exchange Overview dashboard.

• Message Volume
• Message Per Second

Constraints for the Message Tracking event object

The following constraints for the Message Tracking event object identify events as relevant to this data model.

Object name	Constraint
Message Tracking	eventtype=msexchange-msgtrack

Fields for Message Tracking event objects

The following table lists the extracted and calculated fields for the event objects in the model. Note that it does not include any inherited fields.

Object name	Field name	Data type	Description	Example values
Message_Tracking	eventtype	string	Event type of the message	Msexchange-msgtrack
Message_Tracking	message_id	string	A message identifier that is assigned by the Exchange Server server that is currently processing the message. A specific message's value of internal-message-id is different in the message tracking log of every server that is involved in the delivery of the message.
Message_Tracking	recipient	string	A multi-valued field containing the list of recipients.
Message_Tracking	sender	string	The e-mail address specified in the Sender: header field, or the From: header field if Sender: is not present.	sample@splunk.com
Message_Tracking	total_bytes	string	The number of bytes in the message.