topic Re: Splunk 4.x and Exchange 2010 in Getting Data In

Splunk 4.x and Exchange 2010

BastianW — Sat, 14 May 2011 05:42:49 GMT

I´m running Splunk 4.x here and would like to import out flat file MS Exchange eMail tracking files into splunk. BUT it seamed there is no plugin available. Only a old one for splunk 3.x and exchange 2003 can be found.

Has anybody managed to import the eMail tracking files into splunk?

Re: Splunk 4.x and Exchange 2010

gkanapathy — Sat, 14 May 2011 16:51:01 GMT

Exchange 2010 message tracking logs are simply CSV files, and don't require any special plugins for importing into Splunk. I think that the normal "exchange" sourcetype will probably generate a correct CSV field list from the file headers, but if it doesn't, one can be made by just defining the sourcetype:

[exchange2010msgtracking]
DELIMS = ","
FIELDS = date_time,client_ip,client_hostname,server_ip,server_hostname,

And so on...I didn't list out all the fields, but they're listed in the file header anyway.

Re: Splunk 4.x and Exchange 2010

ahall_splunk — Mon, 15 Aug 2011 18:00:19 GMT

As of today, there is a new app: Splunk App for Microsoft Exchange. This supports import of the Microsoft Exchange 2010 Message Tracking logs

Re: Splunk 4.x and Exchange 2010

RIADH — Thu, 09 Feb 2012 18:10:37 GMT

how to configure this app "Splunk for Microsoft Exchange"?
I have already added this addons to my Splunk instance, but I did not get it configured !!!
can any one to help me!!!
please..

Re: Splunk 4.x and Exchange 2010

ahall_splunk — Thu, 09 Feb 2012 18:12:42 GMT

Check out the documentation on docs.splunk.com - this goes step by step on how to configure the app.