Splunk® App for Microsoft Exchange

Splunk App for Microsoft Exchange Reference

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Outlook Web Access

Exch 30 outlookowa.png

This page provides insight into the usage of the Outlook Web Access (OWA) client access method.

The page has panels that chronicle the service's top users by email and IP address.

It also includes panels that list the top operating systems and browsers that access the service. All of these panels sort by count by default, however, you can change the sorting by clicking a header in any of the panels.

The final panel on this dashboard is a line chart that displays total page impressions over time, in pages per minute.

By default, the time period for all of these panels is the last 24 hours. You can change this by editing the dashboard, however.

The dashboard uses Internet Information Server (IIS) logs to produce the events it displays.

How to use this page

  • To find out more about an OWA top user, click on that user in the "Top Users" or "Top Users by IP Addresses" list. The Splunk App for Microsoft Exchange loads the "User Behavior Overview" page and filters results to the specified user.
  • If you click on an entry in the "Top Operating Systems" or "Top Browsers" panels, the Splunk App for Microsoft Exchange brings up the base search that produced the selected operating system or browser, as well as any events which contain the OS or browser.
  • If you click on a node in the "Page Impressions" line chart, the Splunk App for Microsoft Exchange brings up the base search that produced the events at that point in time, along with the events that occurred at that point.
Last modified on 04 April, 2017
PREVIOUS
Outlook (RPC)
  NEXT
ActiveSync

This documentation applies to the following versions of Splunk® App for Microsoft Exchange: 3.4.2, 3.4.3, 3.4.4, 3.5.0, 3.5.1, 3.5.2, 4.0.0, 4.0.1


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters