Can anyone currently using the Splunk App for Microsoft Exchange share your experience so I can guesstimate the license size I need?

[agneticdk]

Hi

I am looking into buying and installing the Splunk App for Microsoft Exchange, but I am a bit in the dark as to how much data the Exchange app logs (excluding the normal AD and TA_windows data that is) - so I can get a guestimate on the license size I need.

Can anyone post about how many exchange servers and mail accounts you have, and the approximate amount of exchange data logged in the msexchange index?

Thank you in advance

André

[malmoore · Accepted solution]

Hi,

The license size you need depends specifically on the amount of data that your Exchange environment generates. The more data that comes out of your Exchange environment, the bigger a license you require.

For example, let's say you have a 10-host Exchange server environment (6 Mailbox, 2 Client Access, 2 Hub/Edge Transport). Each of those hosts generates about 150 MB of Exchange-specific data (some higher, some lower). Therefore, you would need at least a 2 GB per day license to cover just the Exchange Server traffic (1.5 GB + 25% overhead). This is in addition to the license you need for regular Splunk Enterprise to cover the Windows and Active Directory license data.

Remember, you can run the app in trial mode (with no restrictions) for 60 days, just like you can Splunk Enterprise. So, the best way to determine how much license you need is to install an instance with the app and run it for a day or two, determine the daily indexing volume, then get a license that covers that volume plus 5-10% overhead.

Additional information can be found here.

[agneticdk]

Thank you

Yes, I will try to run it in the trial period also. We are just in the scoping phase of a project. We have the enterprise license in place. But we are uncertain of how much we should guess for Exchange license.

I think we maybe should take it as a minimum of 5 GB Exchange pr day, and maybe more. The financial part should be in place before we start investing in time and licenses for the solution. So the above is fine for guessing the license size initially.

Thank you

André