Splunk Search

Splunk for Exchange: Not indexing message tracking logs

SheridanCollege
Explorer

Splunk for Exchange v2.1.0 on Splunk v5.0.2 main search head and indexers. Running splunk universal forwarder v5.0.2 with TA-Exchange-2010-HubTransport on windows 2008R2 with exchange hub transport role.

My problem is that I'm not seeing the Message Tracking logs on the main search head. However, I do see perfmon, sourcetype=MSWindows:2008R2:IIS, sourcetype=MSExchange:2010:Topology, sourcetype=MSExchange:2010:ThrottlingPolicy logs from this host.

How do I troubleshoot this?


[monitor://E:\Exchange Server\MessageTracking]
whitelist=\.log$|\.LOG$
sourcetype=MSExchange:2010:MessageTracking
queue=parsingQueue
index=msexchange

disabled=false

c:\Program Files\SplunkUniversalForwarder\bin>splunk.exe list monitor -auth admin:changeme

Monitored Files:

E:\Exchange Server\MessageTracking

0 Karma
1 Solution

SheridanCollege
Explorer

The problem was that the message tracking logs were in a non-default location

View solution in original post

0 Karma

SheridanCollege
Explorer

The problem was that the message tracking logs were in a non-default location

0 Karma

rashid47010
Communicator

What does that mean
That log files were non default location

Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...