The suggestion mentioned above did not work for me. I had to do the following:
1) I found it necessary to edit the read-audit-logs_2010_2013.ps1 and the read-mailbox-audit-logs_2010_2013.ps1 scripts with
$SessionUri = "http://" + ([System.Net.Dns]::GetHostByName(($env:computerName))).Hostname + "/Powershell/"
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri $SessionUri -Authentication Kerberos
Import-PSSession $Session -AllowClobber
# Add the remove session to the end of the script
Remove-PSSession $Session
2) I could not write to logs nor access various logs, so found it necessary to add the service account running splunk to the Exchange Server Administrators group.
3) Found in the splunkd.log "Get-InboxRule : You must provide a value for this property". Adding a mailbox to the service account fixed this issue.
4) Found in the splunkd.log "Get-MailboxStatistics : Failed to commit the change on object "dbname" because access is denied." Adding the service account to View Only Administrators was not enough. I had to add the service account to Exchange Organization Admins.
Now that this is working I will need to pare back some rights as I do not like service accounts with so many permissions in my environment.
... View more
