Why do panels in the Splunk App for Exchange not specify indexes to search, only eventtype?

[rsethre]

Hi

My new installation of Splunk app for Exchange in a distributed environment does not find data.
If I do a manual search index=msexchange eventtype="msexchange-mailbox-usage", I do get results, so the data is there on the indexers, but the panels in the app just search for the eventtype, without specifying the index, and with that, no data is shown.

What have I missed in the installation guide?

[davidjohnbecket]

I have the same issue - any update on getting the app working rather than updating all the panels across all the dashboards?

[rsethre · Accepted solution]

Corrected this by placing the indexes to be searched by default.
Also, Exchange app does not like the wineventlog in XML format.