All Apps and Add-ons

MS Exchange App - Heavy Forwarder


What is the point of the heavy forwarder outlined in step 4 of the docs?

  1. Next, install a full Splunk instance that has an outbound connection to the Internet. Note: This server should be separate from the central Splunk App for Microsoft Exchange instance and any Exchange servers which also run universal forwarders.

Is that heavy forwarder doing anything that can't be done at the indexer?

0 Karma

Splunk Employee
Splunk Employee

This step is for the TA-SMTP-reputation component (as per step 6) since a full Splunk install has the required Python components to check SMTP server reputation. Keep in mind that this heavy forwarder install will take up resources separate from your indexing tier. Installing the TA-SMTP-Reputation component on your indexing tier is not supported. Another option is to install a heavy forwarder on one of your Exchange servers to handle this requirement, but again, not recommended due to resource requirements.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...