topic Re: HCL Domino and Notes in Getting Data In

HCL Domino and Notes

gillettepd — Fri, 24 Nov 2023 15:18:33 GMT

Can Splunk ingest log data from HCL Domino and Notes?

Re: HCL Domino and Notes

richgalloway — Fri, 24 Nov 2023 17:30:40 GMT

If it's text then Splunk can ingest it. How to ingest it is another matter.

There are a few ways to onboard data into Splunk.

Install a universal forwarder on the server to send log files to Splunk
Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog
Use the server's API to extract data for indexing
Use Splunk DB Connect to pull data from the server's SQL database.
Have the application send data directly to Splunk using HTTP Event Collector (HEC).

Re: HCL Domino and Notes

tscroggins — Sat, 25 Nov 2023 01:05:58 GMT

@gillettepd

I've not used or written code (in C) for Domino since it was still a Lotus product. During IBM's tenure, JDBC Access for IBM Lotus Domino <https://www.openntf.org/main.nsf/project.xsp?r=project/JDBC%20Access%20for%20IBM%20Lotus%20Domino> may have been a viable option for querying LOG.NSF, DOMLOG.NSF, etc. using Splunk DB Connect. The JDBC solution may work with HCL Domino 11.x, but a quick search suggests it will not work with 12.x. The JDBC driver may also be incompatible with DB Connect, depending on its implementation of expected JDBC interfaces. That said, give it a try!

I would evaluate OData access <https://opensource.hcltechsw.com/Domino-rest-api/tutorial/odata/index.html>; however, there is no OData add-on for Splunk. If you're comfortable with Python, REST API Modular Input <https://splunkbase.splunk.com/app/1546> is a (mostly) fee-based add-on that may simplify writing an OData wrapper. Splunk Add-on Builder <https://splunkbase.splunk.com/app/2962> is always an option, but it exposes the Splunk API in a way that may complicate your solution.