All Apps and Add-ons

Can anyone currently using the Splunk App for Microsoft Exchange share your experience so I can guesstimate the license size I need?

agneticdk
Path Finder

Hi

I am looking into buying and installing the Splunk App for Microsoft Exchange, but I am a bit in the dark as to how much data the Exchange app logs (excluding the normal AD and TA_windows data that is) - so I can get a guestimate on the license size I need.

Can anyone post about how many exchange servers and mail accounts you have, and the approximate amount of exchange data logged in the msexchange index?

Thank you in advance

André

0 Karma
1 Solution

malmoore
Splunk Employee
Splunk Employee

Hi,

The license size you need depends specifically on the amount of data that your Exchange environment generates. The more data that comes out of your Exchange environment, the bigger a license you require.

For example, let's say you have a 10-host Exchange server environment (6 Mailbox, 2 Client Access, 2 Hub/Edge Transport). Each of those hosts generates about 150 MB of Exchange-specific data (some higher, some lower). Therefore, you would need at least a 2 GB per day license to cover just the Exchange Server traffic (1.5 GB + 25% overhead). This is in addition to the license you need for regular Splunk Enterprise to cover the Windows and Active Directory license data.

Remember, you can run the app in trial mode (with no restrictions) for 60 days, just like you can Splunk Enterprise. So, the best way to determine how much license you need is to install an instance with the app and run it for a day or two, determine the daily indexing volume, then get a license that covers that volume plus 5-10% overhead.

Additional information can be found here.

View solution in original post

malmoore
Splunk Employee
Splunk Employee

Hi,

The license size you need depends specifically on the amount of data that your Exchange environment generates. The more data that comes out of your Exchange environment, the bigger a license you require.

For example, let's say you have a 10-host Exchange server environment (6 Mailbox, 2 Client Access, 2 Hub/Edge Transport). Each of those hosts generates about 150 MB of Exchange-specific data (some higher, some lower). Therefore, you would need at least a 2 GB per day license to cover just the Exchange Server traffic (1.5 GB + 25% overhead). This is in addition to the license you need for regular Splunk Enterprise to cover the Windows and Active Directory license data.

Remember, you can run the app in trial mode (with no restrictions) for 60 days, just like you can Splunk Enterprise. So, the best way to determine how much license you need is to install an instance with the app and run it for a day or two, determine the daily indexing volume, then get a license that covers that volume plus 5-10% overhead.

Additional information can be found here.

agneticdk
Path Finder

Thank you

Yes, I will try to run it in the trial period also. We are just in the scoping phase of a project. We have the enterprise license in place. But we are uncertain of how much we should guess for Exchange license.

I think we maybe should take it as a minimum of 5 GB Exchange pr day, and maybe more. The financial part should be in place before we start investing in time and licenses for the solution. So the above is fine for guessing the license size initially.

Thank you

André

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...