Hi Splunkers, I have installed the Splunk for Exchange App and Splunk for Sharepoint but i am failing to get the audit logs in.

[francisc]

Errors from Exhange are:
1/31/18 10:23:29.546 AM 01-31-2018 10:23:29.546 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-Mailbox\bin\exchangepowershell.cmd" v14 read-mailbox-audit-logs_2010_2013.ps1"

1/31/18
10:23:26.987 AM
01-31-2018 10:23:26.987 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-Mailbox\bin\exchangepowershell.cmd" v14 read-audit-logs_2010_2013.ps1" figurationTasks.SearchAdminAuditLog

1/31/18
10:23:26.987 AM
01-31-2018 10:23:26.987 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-Mailbox\bin\exchangepowershell.cmd" v14 read-audit-logs_2010_2013.ps1" + FullyQualifiedErrorId : 4ED6395C,Microsoft.Exchange.Management.SystemCon

[ansif]

Click on the event and view it as Raw data will give you exact error.

I came across this issue and I noticed v14 is not the installed version of exchange app.You can check the value on exchanage server registry.

The Registry path will available from exchangepowershell.cmd file.

[francisc]

Thanks ansif.

This was solved after the exchange admin enabled specific actions to be audited on the mailboxes that needed auditing as recommended by Microsoft. Once that was done an audit folder was created on the Exchange server and audit logs started coming to splunk. But SharePoint still no luck.

[zhenqi]

Hello,I meet the same question ,what should I do in the Exchange Server?

[ansif]

If it solved then you can make it as Accepted Answer. Others get benefit over this.