Getting Data In

TA-Exchange-2013-ClientAccess inputs.conf/throttling-counters search macro mismatch

edonze
Path Finder

The object= line in the inputs.conf for TA-Exchange-2013-ClientAccess doesn't match the throttling-counters search macro. See below:

[perfmon://MSExchange_Throttling]
index=perfmon
object=MSExchange User Throttling
instances=*
counters=*
interval=30
disabled=false

throttling-counters macro:

object="MSExchange Throttling"

Tags (2)
0 Karma
1 Solution

edonze
Path Finder

Changed the macro to:

( object="MSExchange Throttling" OR object="MSExchange User Throttling" )

I'm not sure if the more correct fix would have been to update the inputs.conf in the TA, but this made the Client Access Servers dashboard work.

View solution in original post

0 Karma

edonze
Path Finder

Changed the macro to:

( object="MSExchange Throttling" OR object="MSExchange User Throttling" )

I'm not sure if the more correct fix would have been to update the inputs.conf in the TA, but this made the Client Access Servers dashboard work.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...