Is Splunk able to collect exchange 2010 mailbox audit logs from each mailbox and how? The mailbox audit logs are written within each application and stored on each mailbox. Since the mailbox audit logs are not written to windows event folder or a flat file can splunk collect these logs from the mailboxes to a central location and how can it do that?
In version 2.1.2 of the "Splunk App for Microsoft Exchange", the TA-Exchange-2010-MailboxStore has a scripted input that collects the mailbox audit logs into a sourcetype called MSExchange:2010:MailboxAudit
