topic Re: Microsoft Communicator & Instant Messaging in Getting Data In

Microsoft Communicator & Instant Messaging

rwilbert — Thu, 03 Jun 2010 03:23:17 GMT

Can I use Splunk to do forensics on Microsoft Communicator and other IM platforms

Re: Microsoft Communicator & Instant Messaging

DrewO — Thu, 03 Jun 2010 13:36:44 GMT

What exactly do you mean by forensics? Do you mean index individual chat logs?

You could query the chat logs stored in the underlying Communicator SQL database using a scripted input if you have sufficient admin privileges on the Communicator server. The data you would be indexing would be "non-traditional" data for Splunk since it would be fairly free form compared to typical log data, but it would index and be searchable as text output from a scripted input that queried the database.

As to other IM platforms individual chat clients sometimes store chat logs as plain txt files on the local system. If you have Splunk installed locally on the system and knew the directory of the chat logs, Splunk could index them. It would again be "non-traditional" input, but text files index quite easily.

Re: Microsoft Communicator & Instant Messaging

erga00 — Thu, 12 Aug 2010 20:21:26 GMT

I don't know about other IM platforms but with Office Communications Server (server component for Communicator) you need to enable Call Detail Recording. Otherwise, OCS will not record the data you're looking for. With CDR you have the option of collecting just utilization stats or archiving entire IM conversations.

Then it's just a matter of writing a script to export the data from the SQL database CDR stores them in.

Re: Microsoft Communicator & Instant Messaging

kathrin — Wed, 12 Nov 2025 12:58:52 GMT

Yes, you can — as long as the IM platform provides access to logs or message data. For instance, with on-prem or self-hosted solutions like MirrorFly’s Enterprise Instant Messaging Software , you can retain all chat logs within your infrastructure and forward them to Splunk through APIs or syslog. That setup makes it easier to perform forensic analysis or compliance audits compared to hosted services where data access is limited.