Hi Brian, Unfortunately, it looks like you have a problem with Powershell, and those are tricky to diagnose since they depend on who the Splunk instance is running as, what permissions are in effect, if the Powershell KB fixes are in place, and a host of other things that are outside our control. My first step would be to ensure that you are running the latest service pack for Windows 2003, and that your server is allowed to run Powershell local scripts (generally done through GPO). Open up a Powershell prompt (found under Accessories) and make sure you can run basic Powershell commands like Get-Counter (see http://technet.microsoft.com/en-us/library/dd367892.aspx) You can run each of the Powershell scripts independently of the Splunk instance by running them from within an Exchange Management Shell - just change directory to the bin\powershell directory within the TA and run them. They will produce more debugging output that can potentially identify the error. Failing all that, contact our Support group (assuming you have a support contract) and they will be happy to assist. ... View more

Hi Matt, Yes - and it's simple. Create a local macros.conf with the following in it: [msgs-per-hr-gauge] definition = gauge count 0 10000 20000 30000 The first number is the low point of the gauge; the second number is the transition between green and yellow; the third number is the transition between yellow and red, and the fourth number is the top of the gauge. You can set these numbers to whatever you want. While we are at it, take a look at the default/macros.conf file - there are other macros that are commonly replaced (such as the definition of what is an internal IP) that you probably want to look at. ... View more

Yes - the TA for the MailboxStore includes a script that monitors the public folders, and there is a dashboard under the Operations section specifically for Public folders. ... View more

This is my general methodology: Set up the alert so that it fires to the Alert Monitor - this is wholly within Splunk, so it will tell you whether your search is correct and the alert mechanism is working properly. Once you have the alert firing, only then enable your email connection. The email connection is done by setting Manager -> System Settings -> Email Alert Settings. It's an SMTP server. The best method of testing this is by using telnet to port 25. In many organizations, you will also need to configure the SMTP server to allow connections via SMTP from the Splunk server. By testing the connectivity outside of Splunk, you ensure you have the settings correct. Finally, check the logs. do a search index=_internal and look for errors related to email. You will generally see the server name or email address you entered in the error message. This will enable you to narrow down the specific reason that email is failing. Things that have a 550 code in them are produced by the email server (not Splunk) and generally indicate a configuration problem. ... View more

What exactly do you want to alert on? ... View more

Check out the documentation on docs.splunk.com - this goes step by step on how to configure the app. ... View more

Not directly. You can ingest the Exchange Message Tracking Logs, which are not turned on by default, but when they are, they are standard CSV files and one of the fields is the email subject. ... View more

Update to this. The Public Folders are treated differently than Mailbox Folders, and I will be adjusting the app in the next release to take care of this. ... View more

Only general commentary. Every single panel has an underlying search. If you get a "No Data" block, you can roll over that to open the search inspector for the underlying search. Make sure you have the events required and that their fields are being recognized. if you don't have the events or their fields are not being extracted, you won't get the results you want. ... View more

fwd_apps.zip must be unpacked in your $SPLUNK_HOME/etc/apps folder. ... View more

If you are receiving events, but the field extractions are not working, then you likely have not extracted the fwd_apps.zip into the etc/apps on the indexer/search heads. The fwd_apps.zip need to be on all Splunk roles. ... View more

You have two unassociated problems here. Problem #1: Perfmon collection is not working on your CAS server. This is probably because you are using a foreign language version of Exchange. In this case, the counters are translated by Microsoft, and do not have the same name. In order to fix this, you will need to adjust perfmon.conf to collect the right thing (you should attempt to find out what the right thing is by running perfmon.exe and finding the correct counters). You will also need to adjust the searches in the *-performance.xml files (in Splunk_for_Exchange/default/data/ui/views) so that the searches match what is being collected. This is not the only area that requires adjustment for foreign language support, so don't be surprised if dashboards relying on the Windows Event Log are similarly broken. I'll be glad to work with you for support of your language. Contact msexchange@splunk.com to set this up. Problem #2: Powershell scripts are not being decoded properly, with line breaker problems. This problem is likely because you have not placed the fwd-apps.zip, unpacked, everywhere it needs to be. The next release of Splunk App for Microsoft Exchange will fix this problem. Until then, unpack fwd-apps.zip on indexer and search head and ensure the appropriate fwd_exchange* apps are deployed on your Universal Forwarder that sits on the exchange server. There is some excellent documentation on this subject on http://docs.splunk.com ... View more

This is from a CAS server, obviously. What version of Windows, IIS and Exchange are you running? In the short version, the Perfmon counters that we are expecting to be available are not available. ... View more

Within Splunk_for_Exchange/appserver/static, there is a fwd-apps.zip file that contains the right field extractions. Unpack this ZIP file in $SPLUNK_HOME/etc/apps (or, on a Windows box - %SPLUNK_HOME%\etc\apps) ... View more

Each input has a props.conf and transforms.conf for the particular data-set. Per the documentation, you need the specific fwd_* apps for the server role on the forwarder, then ALL the fwd_* apps + Splunk_for_Exchange on the indexer and search head. ... View more

There are several things that could be happening here. The events could be in a different index, you may not have Message Tracking turned on, etc. I'd first of all see if the events are making it into any index. If they are, then look at the eventtypes.conf to determine if the base search for those events are using the correct source type and index. If they are, then is the sourcetype set up to produce the fields the app is expecting. Splunk App for Microsoft Exchange is supported, so you can also utilize your support contract and call the Splunk Support Line. ... View more

Can you possibly contact me at msexchange@splunk.com so I can incorporate this into the next release? ... View more