All Apps and Add-ons

Where must I deploy the "TA-Exchange-2010-xxxx" folders on my Exchange 2010 Server?

BastianW
Path Finder

Hello,

I´m currently try to Install "Splunk App for Microsoft Exchange". But where must I copy the "TA-Exchange-2010-xxxx" folders on my local exchange server?

The "What data the Splunk App for Microsoft Exchange collects" said:

If you are not using a deployment
server, you can locate the TA in
%SPLUNK_HOME%\etc\apps\Splunk_for_Exchange\appserver\addons<TA-Name>
on the universal forwarder.

On the other side the "How to deploy the Splunk App for Microsoft Exchange" refers to:

the TA(s) must be manually copied to
%SPLUNK_HOME%\etc\apps on the Exchange
server(s)

So the question is now

1.)
need I extract the complete "Splunk App for Microsoft Exchange" ZIP file in the %SPLUNK_HOME%\etc\apps folder on my exchange server

or

2.)
need I extract only the "TA-Exchange-2010-xxxx" folders from the ZIP file to %SPLUNK_HOME%\etc\apps on my exchange server

or

3.)
Must I do something completely different?

Note:
We didn´t use a Splunk Deployment Server at the moment. So the changes must be done manually.

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

the good answer is the 2)

The TA are shipped with the app suite.
They are specific per version and server type and are stored in the folder Splunk_for_Exchange\appserver\addons\ (example TA-Exchange-2010-MailboxStore)

You have to untar/unzip the installer, extract the TA you need from the folder, then copy them to the correct server in the %SPLUNK_HOME%\etc\apps\ folder from the forwarders.

View solution in original post

yannK
Splunk Employee
Splunk Employee

the good answer is the 2)

The TA are shipped with the app suite.
They are specific per version and server type and are stored in the folder Splunk_for_Exchange\appserver\addons\ (example TA-Exchange-2010-MailboxStore)

You have to untar/unzip the installer, extract the TA you need from the folder, then copy them to the correct server in the %SPLUNK_HOME%\etc\apps\ folder from the forwarders.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...