Splunk Search

Unable to chart Message Tracking or Client Behavior with Exchange App for Splunk

donwant
Explorer

I am using Exchange 2007 SP3 and it appears that my logs are flowing to the Splunk Instance. Some of the searches and reports do not seem to be working though. For instance I can get Capacity Planning / User population but not message volume. The message tracking menu shows no data as does most of the client behaviour. When I use the Search app I can see that the logs are showing and in the overview of the Exchange App it also shows a significant number of events being indexed.

I have added the local props.conf onto the Splunk Server instance. Do I need any of the other files as local to do the searches for the App?

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

Each input has a props.conf and transforms.conf for the particular data-set. Per the documentation, you need the specific fwd_* apps for the server role on the forwarder, then ALL the fwd_* apps + Splunk_for_Exchange on the indexer and search head.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...