All Apps and Add-ons

Hi Splunkers, I have installed the Splunk for Exchange App and Splunk for Sharepoint but i am failing to get the audit logs in.

francisc
Engager

Errors from Exhange are:
1/31/18 10:23:29.546 AM 01-31-2018 10:23:29.546 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-Mailbox\bin\exchangepowershell.cmd" v14 read-mailbox-audit-logs_2010_2013.ps1"

1/31/18
10:23:26.987 AM
01-31-2018 10:23:26.987 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-Mailbox\bin\exchangepowershell.cmd" v14 read-audit-logs_2010_2013.ps1" figurationTasks.SearchAdminAuditLog

1/31/18
10:23:26.987 AM
01-31-2018 10:23:26.987 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-Mailbox\bin\exchangepowershell.cmd" v14 read-audit-logs_2010_2013.ps1" + FullyQualifiedErrorId : 4ED6395C,Microsoft.Exchange.Management.SystemCon

Tags (1)
0 Karma

ansif
Motivator

Click on the event and view it as Raw data will give you exact error.

I came across this issue and I noticed v14 is not the installed version of exchange app.You can check the value on exchanage server registry.

The Registry path will available from exchangepowershell.cmd file.

0 Karma

francisc
Engager

Thanks ansif.

This was solved after the exchange admin enabled specific actions to be audited on the mailboxes that needed auditing as recommended by Microsoft. Once that was done an audit folder was created on the Exchange server and audit logs started coming to splunk. But SharePoint still no luck.

0 Karma

zhenqi
Explorer

Hello,I meet the same question ,what should I do in the Exchange Server?

0 Karma

ansif
Motivator

If it solved then you can make it as Accepted Answer. Others get benefit over this.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...