Where must I deploy the "TA-Exchange-2010-xxxx" folders on my Exchange 2010 Server?

[BastianW]

Hello,

I´m currently try to Install "Splunk App for Microsoft Exchange". But where must I copy the "TA-Exchange-2010-xxxx" folders on my local exchange server?

The "What data the Splunk App for Microsoft Exchange collects" said:

If you are not using a deployment
server, you can locate the TA in
%SPLUNK_HOME%\etc\apps\Splunk_for_Exchange\appserver\addons<TA-Name>
on the universal forwarder.

On the other side the "How to deploy the Splunk App for Microsoft Exchange" refers to:

the TA(s) must be manually copied to
%SPLUNK_HOME%\etc\apps on the Exchange
server(s)

So the question is now

1.)
need I extract the complete "Splunk App for Microsoft Exchange" ZIP file in the %SPLUNK_HOME%\etc\apps folder on my exchange server

or

2.)
need I extract only the "TA-Exchange-2010-xxxx" folders from the ZIP file to %SPLUNK_HOME%\etc\apps on my exchange server

or

3.)
Must I do something completely different?

Note:
We didn´t use a Splunk Deployment Server at the moment. So the changes must be done manually.

[yannK · Accepted solution]

the good answer is the 2)

The TA are shipped with the app suite.
They are specific per version and server type and are stored in the folder Splunk_for_Exchange\appserver\addons\ (example TA-Exchange-2010-MailboxStore)

You have to untar/unzip the installer, extract the TA you need from the folder, then copy them to the correct server in the %SPLUNK_HOME%\etc\apps\ folder from the forwarders.