Splunk® App for Microsoft Exchange (EOL)

Splunk App for Microsoft Exchange Reference

Acrobat logo Download manual as PDF

On October 22 2021, the Splunk App for Microsoft Exchange will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for Microsoft Exchange.
This documentation does not apply to the most recent version of MSExchange. Click here for the latest version.
Acrobat logo Download topic as PDF

Exchange Web Services

Exch 30 exchangewebs.png

This page shows you information about the usage of the Exchange Web Services (EWS) client access method. Clients such as Apple's Mail client use EWS to access Exchange. Microsoft Outlook 2010 can also use EWS when accessing an Exchange Server 2010 network.

The page has panels that display the method's top users by e-mail and IP address. Also included are panels that list the top operating systems and mail clients that access EWS. All of these panels sort by count by default, however, you can change the sorting by clicking a header in any of the panels.

The final panel on this page shows the total number of requests to EWS over time, in requests per minute.

By default, the time period for all of these panels is the last 4 hours. You can change this by editing the dashboard, however.

The page uses IIS logs to produce the events it displays.

How to use this page

  • To find out more about an EWS top user, click on that user in the "Top Users" or "Top Users by IP Addresses" list. The Splunk App for Microsoft Exchange loads the "User Behavior Overview" page and filters results to the specified user.
  • If you click on an entry in the "Top Operating Systems" or "Top Mail Clients" panels, the Splunk App for Microsoft Exchange brings up the base search that produced the selected operating system or browser, as well as any events which contain the OS or browser.
  • If you click on a node in the "Requests over Time" line chart, the Splunk App for Microsoft Exchange brings up the base search that produced the events at that point in time, along with the events that occurred at that point.[[Category:Web_Services
Last modified on 04 April, 2017
Outlook Anywhere
POP3 and IMAP4

This documentation applies to the following versions of Splunk® App for Microsoft Exchange (EOL): 3.4.2, 3.4.3, 3.4.4, 3.5.0, 3.5.1, 3.5.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters