Errors from Exhange are:
1/31/18 10:23:29.546 AM 01-31-2018 10:23:29.546 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-Mailbox\bin\exchangepowershell.cmd" v14 read-mailbox-audit-logs_2010_2013.ps1"
1/31/18
10:23:26.987 AM
01-31-2018 10:23:26.987 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-Mailbox\bin\exchangepowershell.cmd" v14 read-audit-logs_2010_2013.ps1" figurationTasks.SearchAdminAuditLog
1/31/18
10:23:26.987 AM
01-31-2018 10:23:26.987 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-Mailbox\bin\exchangepowershell.cmd" v14 read-audit-logs_2010_2013.ps1" + FullyQualifiedErrorId : 4ED6395C,Microsoft.Exchange.Management.SystemCon
... View more