topic Can I log Exchange logs without the paid app? in Getting Data In

Can I log Exchange logs without the paid app?

msaz — Mon, 11 Dec 2017 17:40:03 GMT

I would like to send Exchange logs to splunk, but I do not have the pay version of the Exchange app. What kind of functionality will I be missing without the app? Is the app 'needed' to get value out of sending Exchange logs to splunk?

Re: Can I log Exchange logs without the paid app?

adonio — Mon, 11 Dec 2017 17:47:58 GMT

hello there,

you can send Exchange data leveraging the relevant TAs for exchange
https://splunkbase.splunk.com/app/3225/
other TAs resides within the app itself under the appserver folder.
read the docs and verify which TA you need for which data source and Exchange version.
you can pretty much build your own Exchange app by writing your own queries, reports and dashboards

hope it helps.

p.s. i am positive your splunk rep will be happy to provide a temp license key for you to try the app and decide for yourself what you can gain out of it and if its worth for you to buy or develop

Re: Can I log Exchange logs without the paid app?

gjanders — Tue, 12 Dec 2017 08:01:04 GMT

You may wish to consider the Splunk Stream as well as that can decode SMTP protocol and will not require any customisation to your existing logging setup for exchange...

As per the other answer here, the exchange application is not commercial and you can download/install it for free...however the advantage of something like stream will be the ability to see hashes of the attachments of a message and a bit more flexibility in the fields you can access...