Let's say you had a domain "SPLUNK" which is really "splunk.com", then your domain_aliases.csv file would look like this: UNKNOWN,splunk.com SPLUNK,splunk.com If you have UNKNOWN,unknown SPLUNK,splunk.com then you would see what you are seeing. ... View more

Thanks for the bug report. I've filed a bug against this one and it will be incorporated in the next release of the app. ... View more

No, it doesn't need to be there before receiving data - it's used as a lookup, which is search time. Would you mind posting your domain_aliases.csv file? ... View more

Ok - next step - which particular panels on the summary overview have no data? This will narrow down which search is missing information from the field extractions. ... View more

This is definitely possible Create different indices for each environment Create multiple copies of the app - change the directory name and app.conf to match Alter eventtypes.conf and macros.conf so that each app is lookign at different indices Change inputs.conf on each environments TAs to match the indices you have chosen Now you have multiple apps looking at different indices and multiple environments feeding different indices. If you are doing this on a large scale (hosted Exchange environment, for example), there are better ways to do this. Contact your friendly Splunk sales guy and get a conversation going. ... View more

Unfortunately, there is not enough to go on here to even begin to answer this. Here are some things to check: What specific source types are coming in? Is the MSExchange Topology source type coming in? Are the field extractions working? Are they going into the right indices (see eventtypes.conf and macros.conf) As always, more information is better. ... View more

The TA-SMTP-Reputation uses DNS to check the reputation, not HTTP. Your local DNS server must be able to resolve the DNS queries we are doing - there is no proxy involved. Make sure your TA-SMTP-Reputation is up to date, that it is installed in $SPLUNK_HOME/etc/apps and that it is producing data. You can run check_my_reputation.py manually using: splunk cmd python check_my_reputation.py and ensure it outputs reasonable data. One all that is done, you should be set. ... View more

There are two issues here: 1) The logs are not being recognized. You can use the search bar in the Exchange app to search for eventtype=client-iis-logs - it should produce results. If that works, try searching for eventtype=client-owa-usage to see just the OWA information. If these produce data, the dashboards should be populated as well. If the former (client-iis-logs) does not produce data, then it's likely to be an IIS log extraction problem - ensure the MSWindows:*:IIS sourcetype is in the msexchange index or the eventtype definition (in eventtypes.conf) points to the right place. Also, ensure the fields (cs_username, cs_uri_path, etc.) are being extracted. If it isn't, then the transforms.conf in both the TA-Windows-2008R2-IIS and the Splunk_for_Exchange app needs to be altered to match the actual log format. 2) Perfmon is not being pulled properly. Microsoft likes to rename perfmon counters on a regular basis. The actual perfmon counter names are stored in perfmon.conf and used through out the app for plotting. However, they are also documented on technet, which is what we used for this gathering. Use perfmon.exe to get the real names from your system. If your system is not producing specific perfmon counters, remove them from perfmon.conf. (The logs saying Invalid counter are annoying, but harmless, and not counted towards your license usage). As always, if you have a support contract, feel free to open up a support case. Splunk App for Microsoft Exchange is a supported app. ... View more

You did not set up your local/domain_aliases.csv file. ... View more

I've just released Splunk App for Microsoft Exchange v1.1.5 that corrects this problem. The Technology Add-ons have changed to emit the timestamp. ... View more

First off, awesome dashboard. I love it when I see the underlying data being used for more things. Can you give us some idea of the OS, Splunk version and browser (+ version) being used here? ... View more

The local directory does not exist by default. Just create it and place the two files according to the documentation in that directory. ... View more

You've got a mismatch between the app and the Technology Add-ons that are producing the data. The app likely got updated from v1.0 to v1.1 without the deployment of the new Technology Add-ons. All the TA's should be the same version as the Splunk_for_Exchange app. Specifically, the new TA's include a date/time stamp, whereas the originals used DATETIME_CONFIG=CURRENT. There was a corner case for Folder-Usage and Mailbox-Usage when the folder name or mailbox name contained something that looked like a timestamp. In that case, the event was recorded erroneously. ... View more

Wow - answering a year old query. Set up a temporal lookup based on the Windows Security Log (which you will need to ingest from the domain controllers). You can use http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx?i=j to figure out the EventCode that you need to read for the user logons. Note that most windows systems use Kerberos "pre-authentication" to do authentication. So the logon events are not necessarily obvious. Just take a look at the events and extract the username and domain (preferenbly as the CIM compliant fields user and src_nt_domain. ... View more

We don't do anything special for log management with the app. Splunk itself controls the size of the stored logs with a variety of methods. You can read about it here: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutmanagingindexes ... View more

I just had the same issue. Create a single field with all the eventual fields you want, so you have a single MV, then use mvexpand to create the multiple entries, then do another parse on the (now single-) value to extract the three fields. ... View more

The sideview_utils directory needs to be in $SPLUNK_HOME/etc/apps - $SPLUNK_HOME is wherever you have installed Splunk. On my Linux system, this is /opt/splunk/etc/apps/sideview_utils. On my Windows system, this is C:\Program Files\Splunk\etc\apps\sideview_utils. In addition, if you are unpacking the Sideview Utils outside of the Splunk UI, then you need to restart splunk - use "splunk restart" to do this. ... View more

The error message indicates that Sideview Utils is not installed properly. ... View more

Splunk App for Exchange is available on SplunkBase. Just click over to the Apps and search for it. You will need the Google Maps and Sideview Utils apps as well. These are also available from SplunkBase. You can get all the information needed to properly install it from http://docs.splunk.com ... View more