All Apps and Add-ons

Not all WebSphere logs are being indexed

Steve_W
New Member

I have WebSphere installed on Server A and it is configured with SplunkWAS and enabled as a LightWeightForwarder.

The logs are forwarded to Server B. This is working successfully and the WebSphere index is logging all the WebSphere logs except the application logs, SystemOut.log, SystemErr.log, Native*.log.

On Server A, the WebSphere logs are symbolically linked to a different folder, I was thinking this may be the issue except that the FFDC logs are also sym linked and work fine. Any ideas?

I modified the inputs.conf manually in the SplunkWAS application but this also doesn't work.

INPUTS.conf - first entry not working??? Before I changed it the first two monitors were "opt" and not "logs", else the same. Other two monitors are working...

[monitor:///logs/WebSphere6-1/AppServer/profiles/AppSrv01/logs//...] whitelist = native./.log$|.Server/.log$|System./.log$|http_.*/.log$|/.pid$ crcSalt = disabled = 0 index = websphere

[monitor:///logs/WebSphere6-1/AppServer/profiles/AppSrv01/logs/ffdc/...] sourcetype = WebSphere:ServerExceptionLog crcSalt = disabled = 0 index = websphere

[monitor:///opt/WebSphere6-1/AppServer/profiles/AppSrv01/...] whitelist = javacore.*/.txt$ crcSalt = disabled = 0 index = websphere

Tags (1)
0 Karma

Steve_W
New Member

Ok so I got it to work....but to make it work I had to change the whitelist, see below for details.

[monitor:///logs/WebSphere6-1/AppServer/profiles/AppSrv01/logs/...] whitelist = SystemOut.log|SystemErr.log|native_stdout.log|native_stderr.log crcSalt = disabled = 0 index = XXXX

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...