This page shows you information about the usage of Microsoft Outlook over the local area network. This client access method is relevant only for Exchange 2007 in many cases.
The page has panels that display the method's top users by e-mail and IP address. Also included is a panel that shows the total number of RPC sessions over time, in connections per minute.
By default, the time period for all of these panels is the last 24 hours. You can change this by editing the dashboard, however.
The dashboard uses Exchange Audit event logs to produce the events it displays.
How to use this page
- To find out more about an Outlook RPC top user, click on that user in the "Top Users" or "Top IP Addresses" list. The Splunk App for Microsoft Exchange loads the "User Behavior Overview" page and filters results to the specified user.
- If you click on a node in the "RPC Sessions over Time" line chart, the Splunk App for Microsoft Exchange brings up the base search that produced the events at that point in time, along with the events that occurred at that point.
External Logins Map
Outlook Web Access
This documentation applies to the following versions of Splunk® App for Microsoft Exchange (EOL): 3.4.2, 3.4.3, 3.4.4, 3.5.0, 3.5.1, 3.5.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3