Getting Data In

Does Splunk Support IBM HPEL log ingestion

sbbadri
Motivator

I need to ingest a hpel log file produce from IBM websphere server. I need to know does splunk support this.

Any pointer is appreciable.

Regards,
Badri

Tags (2)
0 Karma

m4him7
Path Finder

The log needs to be plain text.
Each event needs a time stamp.
If that is true you read it in and then create field extracts with regex. You can manually do the regex or let Splunk's GUI create the regex.

I have read in logs that have unusal timestamps
June 11 2015
06:00 some event data
06:12 some event data
06:14 some event data
June 12 2015
00:05 some data
00:15 some data

I have written scripts in powershell and phython that simply reads until the date is found
then read the times and insert the date before the time
write out the newly formated event line to a new file
keep reading until a new date is found.
write new log to disk
splunk reads the new log
I have also used a script output to send the log directly to Splunk. Both are really simple to do.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...