Splunk App for Exchange: DNSLB shows as N/A

[clymbouris]

Hi

I have the app working great. I'm a bit confused on what DNSLB needs to get out. We're using a proxy to access the internet so I set the proxy settings for the domain user running splunk services (I just run IE as the splunk user and set proxy settings). This doesn't seem to work. I can't see any traffic going out from the fw either.

So basically I was wondering:
- Is there any other place where I have to set the proxy settings for this to work?
- Can I have the IPs for the Cisco servers so I can monitor the traffic going out?

Many thanks
Costas

[ahall_splunk]

The TA-SMTP-Reputation uses DNS to check the reputation, not HTTP. Your local DNS server must be able to resolve the DNS queries we are doing - there is no proxy involved.

Make sure your TA-SMTP-Reputation is up to date, that it is installed in $SPLUNK_HOME/etc/apps and that it is producing data. You can run check_my_reputation.py manually using:

splunk cmd python check_my_reputation.py

and ensure it outputs reasonable data. One all that is done, you should be set.