The "MS Exchange" app does a good job at reporting on services that are down; however, what if the service is down intentionally? What is the best way to tell the app NOT to alert on an intentionally stopped service?
The use-case is: An Exchange-2010 environment. They do not have "Edge" servers and have intentionally disabled the MSExchangeEdgeSync service. This service is still installed so when queried via powershell, the "MS Exchange" app reports that this service is down, and the dashboards alert as such.
I can see several ways to achieve the goal (maybe adjust the search or eventtype); however, these approaches do not easily accommodate if there is a blended environment where the service is intentionally stopped on some systems but running (and therefore should be monitored) on others.
Instead of handling this in Splunk, is it better to have the "MS Exchange" admin remove the stopped service from the system?
Advice appreciated.