https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-from-the-AIX-errpt-into-Splunk/m-p/126913#M26128 <P>Why wouldn't you just use syslog.config entry "*.err @splunkhost:port" or does this give different results?</P> Fri, 08 May 2020 00:47:37 GMT barberoon 2020-05-08T00:47:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-from-the-AIX-errpt-into-Splunk/m-p/126910#M26125 <P>How to get data from the AIX errpt into Splunk?</P> Thu, 10 Apr 2014 10:40:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-from-the-AIX-errpt-into-Splunk/m-p/126910#M26125 sbennacer_splun 2014-04-10T10:40:11Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-from-the-AIX-errpt-into-Splunk/m-p/126911#M26126 <P>The errpt is command to generate a report of logged errors, you can send the result to splunk in different way , you can use a forwarder to forward the generated report of logged errors to Splunk<BR /> Or you can create and ODM entry to run the logger command whenever an error is logged<BR /> 1. Create an ODM entry to run the "logger" command whenever an error is logged.</P> <PRE><CODE> # vi /tmp/syslog.add errnotify: en_name="syslog1" en_persistenceflg = 1 en_method = "logger -pnotice Msg from Error Log: $(errpt -a -l $1 | grep -v 'ERROR_ID TIMESTAMP’)" </CODE></PRE> <OL> <LI><P>Add the entry to ODM</P> <PRE><CODE># odmadd /tmp/syslog.add </CODE></PRE></LI> <LI><P>Add a syslog entry to forward "notice" priority messages to splunk host “splunkhost "</P> <PRE><CODE># vi /etc/syslog.conf *.notice @splunkhost:port </CODE></PRE></LI> <LI><P>Refresh the syslog demon to pick up the new entry</P> <P>refresh -s syslogd</P></LI> <LI><P>In Splunk you will need to create new data input for syslog following the doc <A href="http://docs.splunk.com/Documentation/Storm/Storm/User/Howtosetupsyslog">http://docs.splunk.com/Documentation/Storm/Storm/User/Howtosetupsyslog</A></P></LI> </OL> <P>note : IBM link about errpt command <BR /> <A href="http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.aix.cmds/doc/aixcmds2/errpt.htm">http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.aix.cmds/doc/aixcmds2/errpt.htm</A> </P> Thu, 10 Apr 2014 10:58:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-from-the-AIX-errpt-into-Splunk/m-p/126911#M26126 sbennacer_splun 2014-04-10T10:58:21Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-from-the-AIX-errpt-into-Splunk/m-p/126912#M26127 <P>But there have a problem, the log not format, all in a line:</P> <PRE><CODE>Msg from Error Log: --------------------------------------------------------------------------- LABEL: OPMSG IDENTIFIER: AA8AB241 Date/Time: Fri Sep 2 15:33:12 CST 2016 Sequence Number: 77 Machine Id: 00FA6AD04C00 Node Id: PDC_F1M3_C04_P02_zabbixtest Class: O Type: TEMP WPAR: Global Resource Name: OPERATOR Description OPERATOR NOTIFICATION User Causes ERRLOGGER COMMAND Recommended Actions REVIEW DETAILED DATA Detail Data MESSAGE FROM ERRLOGGER COMMAND this is a Error log test. </CODE></PRE> Mon, 05 Sep 2016 06:28:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-from-the-AIX-errpt-into-Splunk/m-p/126912#M26127 liupeng0518 2016-09-05T06:28:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-from-the-AIX-errpt-into-Splunk/m-p/126913#M26128 <P>Why wouldn't you just use syslog.config entry "*.err @splunkhost:port" or does this give different results?</P> Fri, 08 May 2020 00:47:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-from-the-AIX-errpt-into-Splunk/m-p/126913#M26128 barberoon 2020-05-08T00:47:37Z