Splunk Search

Unable to chart Message Tracking or Client Behavior with Exchange App for Splunk

donwant
Explorer

I am using Exchange 2007 SP3 and it appears that my logs are flowing to the Splunk Instance. Some of the searches and reports do not seem to be working though. For instance I can get Capacity Planning / User population but not message volume. The message tracking menu shows no data as does most of the client behaviour. When I use the Search app I can see that the logs are showing and in the overview of the Exchange App it also shows a significant number of events being indexed.

I have added the local props.conf onto the Splunk Server instance. Do I need any of the other files as local to do the searches for the App?

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

Each input has a props.conf and transforms.conf for the particular data-set. Per the documentation, you need the specific fwd_* apps for the server role on the forwarder, then ALL the fwd_* apps + Splunk_for_Exchange on the indexer and search head.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...