All Apps and Add-ons

Why do panels in the Splunk App for Exchange not specify indexes to search, only eventtype?

Engager

Hi

My new installation of Splunk app for Exchange in a distributed environment does not find data.
If I do a manual search index=msexchange eventtype="msexchange-mailbox-usage", I do get results, so the data is there on the indexers, but the panels in the app just search for the eventtype, without specifying the index, and with that, no data is shown.

What have I missed in the installation guide?

0 Karma
1 Solution

Engager

Corrected this by placing the indexes to be searched by default.
Also, Exchange app does not like the wineventlog in XML format.

View solution in original post

0 Karma

Path Finder

I have the same issue - any update on getting the app working rather than updating all the panels across all the dashboards?

0 Karma

Engager

Corrected this by placing the indexes to be searched by default.
Also, Exchange app does not like the wineventlog in XML format.

View solution in original post

0 Karma