App Install/Uninstall/Update: Splunk Add-on for Microsoft Exchange on Splunk Cloud

Applicability

Description

The Splunk Add-on for Microsoft Exchange collects mailbox, client access, and hub transport data from your Microsoft Exchange Server hosts.

1. This add-on comprises five add-ons that can be selectively installed only on forwarders: Exchange-ClientAccess, Exchange-Mailbox, Exchange-HubTransport, Windows-Exchange-IIS, and SMTP-Reputation.
2. The #5663- Splunk Add-on for Microsoft Exchange Indexes to define the indexes used by Splunk Add-on for Microsoft Exchange is to also be installed on the Splunk Cloud instance.

• To install app #3225 on the cloud instance, as per the matrix only #5663- Splunk Add-on for Microsoft Exchange Indexes will be installed on the user's Cloud instance.
• The rest of the sub-components of #3225 should be installed on universal forwarders and heavy forwarders i.e. Forwarding Tiers (on the user's side) by the user themselves.
• Before installation of #5663, it is necessary that the user installs all the sub-components as per the matrix.

• For the Splunk Classic stack app #5663 will be installed only on Indexers.

• For the Splunk Victoria/Noah stack app #5663 will be installed throughout the stack, to maintain stack uniformity.

Investigation

• App #5663 can be installed by SSAI on the search head for Victoria stack.
• #3225 is non- SSAI as its component #5663 is to be installed on IDX.

Resolution

• #5563 does not have a launch button because it does not have a User Interface. (Follow documentation to Install and Configure Splunk Add-on for Microsoft Exchange Indexes to the Cloud environment)
• Installing apps/add-ons on search head, heavy forwarders, and Universal forwarders.(Document )

Related Links