topic Re: Splunk for Microsoft Exchange : deployment question in Getting Data In

Splunk for Microsoft Exchange : deployment question

NewMilenium — Mon, 28 Sep 2020 13:06:46 GMT

Hello,

my question is quite simple : is that possible to use Splunk for Microsoft Exchange application only splunk-sided, not installing anything on the Exchange Servers, so that it only analyses the logs splunk already received?

If not, my problem is the next one : I must use splunk to create reports about the logs we receive (and so, it has to "recognize" them). At the moment, I can't find with just splunk how to recognize the Microsoft Exchange source type for the logs (list of types currently proposed by splunk : "access_combined", "apache_error", "csv", "iis", "log4j", "log4php", "syslog"). So, if that app' can't help me neither, I'll have to start working on an app' to do this... and that's something I really really would like to avoid...

Thank you for any answer, for the time spent.

Re: Splunk for Microsoft Exchange : deployment question

ahall_splunk — Tue, 15 Jan 2013 15:25:47 GMT

It is not possible for the Splunk for Microsoft Exchange to be fully functional and not install anything on the Exchange server. Too many things are embedded in the Exchange Powershell and/or .NET structures that we read as part of this.

However, you can still use PARTS of the app to handle your logs. For instance, let's say you put your message tracking logs on a file share instead. You can import them with the sourcetype MSExchange:2010:MessageTracking (or replace the 2010 with 2007 or 2013, depending on your version), then they will be recognized by the props/transforms that are in the Splunk for Microsoft Exchange. In this case, you will need the sections of the props/transforms from the app that deal with the message tracking logs, plus a file input that reads the files and sets the sourcetype.

Re: Splunk for Microsoft Exchange : deployment question

NewMilenium — Tue, 15 Jan 2013 16:02:54 GMT

And with such configuration, I would be able to use some parts of the menus and such with graphical statistics and reports?
Very little question, by the way : would the PDF reports have any chance to work? (I know the little trick with XML file and

autoRun="true"

to put in)

Thank you a lot, I will post again here in next days if needed.

Re: Splunk for Microsoft Exchange : deployment question

ahall_splunk — Tue, 15 Jan 2013 16:05:03 GMT

No, you would not. The Splunk App for Exchange requires a good set of data to determine the function of each machine.

Is there a reason you cannot install the Splunk UF on the Exchange host?

Re: Splunk for Microsoft Exchange : deployment question

NewMilenium — Tue, 15 Jan 2013 16:34:51 GMT

Well my enterprise cannot and doesn't want to access to the clients' servers, in (very) short.
This might change in the future though, so, I'll use this "question" again here if needed.

Thanks for the information, you've been much help!