Unable to chart Message Tracking or Client Behavior with Exchange App for Splunk

[donwant]

I am using Exchange 2007 SP3 and it appears that my logs are flowing to the Splunk Instance. Some of the searches and reports do not seem to be working though. For instance I can get Capacity Planning / User population but not message volume. The message tracking menu shows no data as does most of the client behaviour. When I use the Search app I can see that the logs are showing and in the overview of the Exchange App it also shows a significant number of events being indexed.

I have added the local props.conf onto the Splunk Server instance. Do I need any of the other files as local to do the searches for the App?

[ahall_splunk]

Each input has a props.conf and transforms.conf for the particular data-set. Per the documentation, you need the specific fwd_* apps for the server role on the forwarder, then ALL the fwd_* apps + Splunk_for_Exchange on the indexer and search head.