Does the Splunk App for Microsoft Exchange have a built-in search to show client mode?

[mikesangray]

I know there's information in the RPC logs regarding client mode, just wondering if this app has a built-in search to show client mode?

[jkat54]

I do not see this field anywhere in props.conf, etc. within the application itself. Disclaimer: I do not use this application nor have i ever. I just downloaded the app, opened all the files and searched for "mode".

To get Client Mode, you can create a powershell input:

This powershell command will return Name, ClientName and ClientMode:

Get-LogonStatistics “UserName” | FL Name, ClientName, ClientMode

So if you like the app otherwise, download it, install it, and then add a powershell script to it as a scripted input, or write a job on the exchange server to run the powershell command and write to file:

Get-LogonStatistics “UserName” | FL Name, ClientName, ClientMode | export-csv ...