Getting Data In

Can I log Exchange logs without the paid app?

msaz
Path Finder

I would like to send Exchange logs to splunk, but I do not have the pay version of the Exchange app. What kind of functionality will I be missing without the app? Is the app 'needed' to get value out of sending Exchange logs to splunk?

0 Karma

gjanders
SplunkTrust
SplunkTrust

You may wish to consider the Splunk Stream as well as that can decode SMTP protocol and will not require any customisation to your existing logging setup for exchange...

As per the other answer here, the exchange application is not commercial and you can download/install it for free...however the advantage of something like stream will be the ability to see hashes of the attachments of a message and a bit more flexibility in the fields you can access...

0 Karma

adonio
Ultra Champion

hello there,

you can send Exchange data leveraging the relevant TAs for exchange
https://splunkbase.splunk.com/app/3225/
other TAs resides within the app itself under the appserver folder.
read the docs and verify which TA you need for which data source and Exchange version.
you can pretty much build your own Exchange app by writing your own queries, reports and dashboards

hope it helps.

p.s. i am positive your splunk rep will be happy to provide a temp license key for you to try the app and decide for yourself what you can gain out of it and if its worth for you to buy or develop

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...