All Apps and Add-ons

Splunk Add-on for IBM WebSphere Application Server: How to configure the add-on to read from syslog server where rsyslog has forwarded the files?

john_glasscock
Path Finder

The Websphere admin has rsyslog the files over to a syslog server. I am having issues configuring the Splunk Add-on for IBM WebSphere Application Server to pull the log files from the directory. Normally, I would just setup a monitor stanza, but this Add-on doesn't seem to like it. Any help would be appreciated.

Thanks

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@john.glasscock - Did the answer provided by goodsellt help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

goodsellt
Contributor

Since the addon probably is expecting the native log file lines and you're probably getting a syslog header attached to your lines, you'll likely to do something like this:
- Create a dummy sourcetype like "ibm-websphere-syslog" and monitor your rsyslog files with that.
- In the dummy sourcetype, setup a props and transforms so that it seds out the syslog header, then transforms the line to the "proper" ibm websphere sourcetype from the addon.
- Verify that your data is being properly parsed as the real sourcetype and the fields expected from the addon are appearing.

You could also redo the props.conf and transforms.conf statements to account for your syslog header and throw them in the local dir of the addon.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...