How to report or search for exchange logs?

[chrodriguez]

Just started to get logs for our 2019 exchange environment, I'm not a splunk admin and have been advised to use these commands to search all logs in Exchange send/rcv, but seeing what other search queries I can build/use to search by subject, user, sender etc

1. index=msexchange sourcetype=msexchange:protocollog:smtpsend
2. index=msexchange sourcetype=msexchange:protocollog:smtpreceive
   
   

[richgalloway]

Running those queries should produce a list of "Interesting Fields" on the left side of the results page.  Right-click on the field to see the top values.  Left-click on a field to add it to your query.

Check out the training at https://education.splunk.com/course/intro-to-splunk-elearning