Splunk for Exchange: Not indexing message tracking logs

SheridanCollege — Thu, 14 Feb 2013 18:59:12 GMT

Splunk for Exchange v2.1.0 on Splunk v5.0.2 main search head and indexers. Running splunk universal forwarder v5.0.2 with TA-Exchange-2010-HubTransport on windows 2008R2 with exchange hub transport role.

My problem is that I'm not seeing the Message Tracking logs on the main search head. However, I do see perfmon, sourcetype=MSWindows:2008R2:IIS, sourcetype=MSExchange:2010:Topology, sourcetype=MSExchange:2010:ThrottlingPolicy logs from this host.

How do I troubleshoot this?

[monitor://E:\Exchange Server\MessageTracking]
whitelist=\.log$|\.LOG$
sourcetype=MSExchange:2010:MessageTracking
queue=parsingQueue
index=msexchange

disabled=false

c:\Program Files\SplunkUniversalForwarder\bin>splunk.exe list monitor -auth admin:changeme

Monitored Files:

E:\Exchange Server\MessageTracking

Re: Splunk for Exchange: Not indexing message tracking logs

SheridanCollege — Thu, 31 Jul 2014 19:20:38 GMT

The problem was that the message tracking logs were in a non-default location

Re: Splunk for Exchange: Not indexing message tracking logs

rashid47010 — Sun, 17 Jul 2016 19:15:45 GMT

What does that mean
That log files were non default location

topic Re: Splunk for Exchange: Not indexing message tracking logs in Splunk Search

Splunk for Exchange: Not indexing message tracking logs

disabled=false

E:\Exchange Server\MessageTracking

Re: Splunk for Exchange: Not indexing message tracking logs

Re: Splunk for Exchange: Not indexing message tracking logs