Older question - but this still came up as a hit on my search results while trying to help another customer, so this might be useful here. You have to run (or let the splunk agent run and manage) the monitors and scripts responsible for monitoring exchange related logs. To start - I would locally (like to your laptop) download the Add-On, https://splunkbase.splunk.com/app/3225 From there, explore the inputs.conf configurations available in the subdirectories. These define what is to be collected. If you notice, there are a ton of inputs available. These are set to OFF by default. Let's take a look at one of them under \TA-Windows-Exchange-IIS\default\inputs.conf ####Exchange Server Version 2010 - Start#### [monitor://C:\Program Files\Microsoft\Exchange Server\V14\Logging\Ews] whitelist=\.log$|\.LOG$ sourcetype=MSWindows:2010EWS:IIS queue=parsingQueue index=msexchange disabled=true initCrcLength=8192 The monitor stanza is defining the location of the path - so in this case, the files are stored in that file path (...\logging\EWS). The whitelist/allowist statement specifies that all files in that directory ending in .log or .LOG are to be allowed. The 'disabled' statement is currently set to false, as per the default.  To get this working, copy this stanza to a /local/inputs.conf directory, change disabled to '=false' and deploy to the machine that is running exchange. You will need a a UF, or Heavy Forwarder or some other way to getting data to splunk indexers. Use a similar process for the many other inputs you have available.  Do not turn on all inputs unless you really need them and have done capacity planning as it can be a lot of volume.  ... View more

Hi, thank you for your feedback.  The add-on is installed on indexer, searchheads and universal forwarder. However fields like below are not beeing mapped   00/00/0000 00:00:00 PM LogName=Application EventCode=33205 EventType=0 ComputerName= SourceName=MSSQLSERVER Type=Information RecordNumber=123456 Keywords=Audit Failure, Classic TaskCategory=Logon OpCode=None Message=Audit event: audit_schema_version:1 event_time:2023-00-00 00:00:00.000000 sequence_number:1 action_id:LGIF succeeded:false is_column_permission:false session_id:0 server_principal_id:0 database_principal_id:0 target_server_principal_id:0 target_database_principal_id:0 object_id:0 user_defined_event_id:0 transaction_id:0 class_type:LX permission_bitmask:00000000000000000000000000000000 sequence_group_id: session_server_principal_name: server_principal_name: server_principal_sid: database_principal_name: target_server_principal_name: target_server_principal_sid: target_database_principal_name: server_instance_name:XXXXXXXXXX database_name: schema_name: object_name: statement: additional_information: user_defined_information:   Should all fields not be extracted, as the add-on has these field extractions. Or does it only work with dbconnect? Hopefully somebody can support and advise before I start working on a customized solution which I am trying to avoid.   ... View more

What was your conclusion? Which method did you use? ... View more

Hi Andreas, thank you for the quick response. Does this mean you did the mapping and field extraction all by yourself for?  Best, O. ... View more

If you can't find anything suitable on splunkbase, then you'll have to create your own CIM mapping.  Examine the available fields then add the necessary EVAL, EXTRACT, or FIELDALIAS commands to create CIM fields for the datamodel(s) you plan to use. ... View more

Hi @ojay, you don't need an external Load Balancer, you can use the same mechanism of auto load balancing that you use to directly send data to Indexers, even if you send to two Heavy Forwarders (for more infos see at https://docs.splunk.com/Documentation/Splunk/8.2.6/Forwarding/Setuploadbalancingd). It's always a good practice to have at least two HFs to avoid Single Point of Failures. If you want, you could also use two Universal Forwarders as intermediate, this choice depends on if you want to elaborate data before Indexers or not (UFs cannot elaborate data, HFs can). About the active/passive mode, the best approach is two HFs always active that distribute load in normal work and manage fail over in maintenance or fail conditions. Ciao. Giuseppe ... View more

Hi there, what method did you end up using? Any experience that you can share? O. ... View more

It depends on how busy the HF is, but it should be able to handle a HEC input. ... View more

Does anyone know all the azure instances IP or URL that I need to establish a connectivity with?  ... View more

In case i use both add-on's do I need to create two seperate application integrations? ... View more

Thanks everyone, i have decided to create something like "technology_vendor" Jay ... View more

Hi Oj, i wrote several blogposts about monitoring splunk using nagios on batchworks.de: one thing you would like to monitor is e.g. license usage on your licenseserver. a cornercase is to monitor for old ufs..  out-of-the-box there good checks are included in the Managementconsole. Those alerts should trigger your nagios. in the end i would suggest an "end-to-end" test using a technical user and doing a search in you splunk instance - by using rest api for example. At you could be quite sure that everthing is running smooth.  those test including basic os montoring should be a good start. regards, Andreas ... View more

Hi @ojay, you have to put the Load balancer in front of the two (or more) Heavy Forwarders. In other words, you configure on the LB a virtual IP to use as front end to receive syslogs from your appliances. Then the LB sends these logs to the HFs on the ports you opened. About ports, you could use the same ports on LB and HFs (e.g. 514). About firewalls rules, if they are on the same network there isn't any problem, if they are in diferent networks, you have to open the relative routes between LB and HFs. Remember to configure an heart beat on the HFs so the LB can know if the HFs are alive: e.g. you could create an alert that pings the LB every minute. Ciao. Giuseppe ... View more

I'm not sure it there is TA/App for Logpoint, but you could use log files directly or define that those (or subset) have sent over syslog to your syslog server and then collect from there as usually. ... View more

Hi,   There is a setting in serverclass.conf that has this function: excludeFromUpdate Documentation: https://docs.splunk.com/Documentation/Splunk/8.2.2/Updating/Excludecontent   Hope this helps ... View more

Splunk doesn't support Win2003.  Perhaps you can find a third-party tool that can export the event log into a  form Splunk can ingest. ... View more

If you are running this e.g. user splunk have you change ownership of /opt/splunkforwarder (or what is your splunk home) to this user? If not then when you are starting splunk, it cannot write to conf-files. r. Ismo ... View more

Any app in the /etc/apps directory would not be affected from the forwarder management side of things. The issue is more than likely that you are setting your configs in the $splunk_home/etc/apps/appname/default/.. directory. When you create a base config/app, your configs need to live in the /appname/local/*.conf directory. This lets Splunk know that these are custom configs and should not be changed. Additionally, make sure that you dont have any affecting stanzas matching your inputs files. Check with btool if there are any inputs taking precedence before your config: splunk btool inputs list <stanza> --debug ... View more