topic Re: Getting mainframe logs into splunk in Getting Data In

Getting mainframe logs into Splunk?

ChhayaV — Mon, 20 Mar 2023 14:37:03 GMT

hi,

How can i get logs from mainframe into splunk is there any forwarder avaialble? if not whatelse can be done to get logs from mainframe?

Thanks and Regards

Re: Getting mainframe logs into splunk

dart — Wed, 31 Jul 2013 12:59:11 GMT

For AS/400 there is a splunk app for AS/400.
For other mainframes data is typically accessed via an NFS mounted share on a forwarder or via JDBC talking to e.g. DB2

Re: Getting mainframe logs into splunk

jreda — Wed, 04 Feb 2015 21:29:36 GMT

Ironstream from Syncsort can do all of this work for you. It will handle all of the issues related to SYSLOG, z/OS SMF records, log4j and flat files. It deals with the compression, the triplets, the binary data and converts the data from EBCDIC to ASCII. It does this very efficiently, even offloading a lot of the work to a zIIP engine in order to keep the MSU cost of this work to an absolute minimum. This is all done in real time to give you the best data latency possible while not impacting the existing workload on your system.

Re: Getting mainframe logs into splunk

khalidewaidah — Thu, 18 May 2017 08:48:52 GMT

We will use Ironstream but how we can get data

Re: Getting mainframe logs into splunk

jeastman — Thu, 18 May 2017 14:00:08 GMT

Hello Khalidewaidah,

Can you elaborate on what your question is about Ironstream? Are you wanting to try the product out or do you just have questions about how Ironstream obtains the data?

If you want to try Ironstream out, you can download a version that just works for SYSLOG data from the Syncsort Website here:
http://www.syncsort.com/en/Products/Mainframe/Ironstream

Re: Getting mainframe logs into splunk

DalJeanis — Thu, 18 May 2017 14:27:55 GMT

@khalidewaidah - you will receive the best help if you ask a new question and refer to this one in your question. Include as much information as possible about your current situation:

For example -

We would like to use Ironstream to get our mainframe logs into splunk. What are the steps that we need to take to make that happen?

Is that the question that you would like to ask?

Re: Getting mainframe logs into splunk

tldenney — Thu, 29 Jun 2017 16:28:51 GMT

IBM Common Data Provider for z Systems (CDPz) is the best option for sending Mainframe logs to Splunk.

CDPz can send a wide variety of data including 140 data sources and 100+ SMF record types. More specifically, CDPz can support the following:

• SMF records
• SYSLOG (IBM z/OS System Log and USS SyslogD)
• JOBLOGs
• Application logs (IBM CICS Transaction Server logs and IBM WebSphere Application Server logs)

CDPz also has advanced filtering capabilities including RegEx and time filtering that can be set up using the built-in web configuration tool shown below.

More information on IBM Common Data Provider for z Systems can be found directly on Splunkbase.

Re: Getting mainframe logs into splunk

tldenney — Wed, 20 Sep 2017 16:39:48 GMT

The following Splunk Blog outlines how Splunk and IBM are partnering to help customers integrate IBM Z (Mainframe) Data and Insights into Splunk software:

https://www.splunk.com/blog/2017/08/22/insane-in-the-mainframe-splunk-and-ibm-partner-to-provide-end-to-end-visibility-for-joint-customers.html

Re: Getting mainframe logs into splunk

ArgosTAAPCC — Mon, 20 Mar 2023 11:04:41 GMT

How to install,configure and setup Ironstream to get data into splunk from mainframe systems?