Hi
My new installation of Splunk app for Exchange in a distributed environment does not find data.
If I do a manual search index=msexchange eventtype="msexchange-mailbox-usage"
, I do get results, so the data is there on the indexers, but the panels in the app just search for the eventtype, without specifying the index, and with that, no data is shown.
What have I missed in the installation guide?
Corrected this by placing the indexes to be searched by default.
Also, Exchange app does not like the wineventlog in XML format.
I have the same issue - any update on getting the app working rather than updating all the panels across all the dashboards?
Corrected this by placing the indexes to be searched by default.
Also, Exchange app does not like the wineventlog in XML format.