All Apps and Add-ons

Can anyone currently using the Splunk App for Microsoft Exchange share your experience so I can guesstimate the license size I need?

agneticdk
Path Finder

Hi

I am looking into buying and installing the Splunk App for Microsoft Exchange, but I am a bit in the dark as to how much data the Exchange app logs (excluding the normal AD and TA_windows data that is) - so I can get a guestimate on the license size I need.

Can anyone post about how many exchange servers and mail accounts you have, and the approximate amount of exchange data logged in the msexchange index?

Thank you in advance

André

0 Karma
1 Solution

malmoore
Splunk Employee
Splunk Employee

Hi,

The license size you need depends specifically on the amount of data that your Exchange environment generates. The more data that comes out of your Exchange environment, the bigger a license you require.

For example, let's say you have a 10-host Exchange server environment (6 Mailbox, 2 Client Access, 2 Hub/Edge Transport). Each of those hosts generates about 150 MB of Exchange-specific data (some higher, some lower). Therefore, you would need at least a 2 GB per day license to cover just the Exchange Server traffic (1.5 GB + 25% overhead). This is in addition to the license you need for regular Splunk Enterprise to cover the Windows and Active Directory license data.

Remember, you can run the app in trial mode (with no restrictions) for 60 days, just like you can Splunk Enterprise. So, the best way to determine how much license you need is to install an instance with the app and run it for a day or two, determine the daily indexing volume, then get a license that covers that volume plus 5-10% overhead.

Additional information can be found here.

View solution in original post

malmoore
Splunk Employee
Splunk Employee

Hi,

The license size you need depends specifically on the amount of data that your Exchange environment generates. The more data that comes out of your Exchange environment, the bigger a license you require.

For example, let's say you have a 10-host Exchange server environment (6 Mailbox, 2 Client Access, 2 Hub/Edge Transport). Each of those hosts generates about 150 MB of Exchange-specific data (some higher, some lower). Therefore, you would need at least a 2 GB per day license to cover just the Exchange Server traffic (1.5 GB + 25% overhead). This is in addition to the license you need for regular Splunk Enterprise to cover the Windows and Active Directory license data.

Remember, you can run the app in trial mode (with no restrictions) for 60 days, just like you can Splunk Enterprise. So, the best way to determine how much license you need is to install an instance with the app and run it for a day or two, determine the daily indexing volume, then get a license that covers that volume plus 5-10% overhead.

Additional information can be found here.

agneticdk
Path Finder

Thank you

Yes, I will try to run it in the trial period also. We are just in the scoping phase of a project. We have the enterprise license in place. But we are uncertain of how much we should guess for Exchange license.

I think we maybe should take it as a minimum of 5 GB Exchange pr day, and maybe more. The financial part should be in place before we start investing in time and licenses for the solution. So the above is fine for guessing the license size initially.

Thank you

André

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...