Does Splunk Support IBM HPEL log ingestion

sbbadri — Fri, 12 Jun 2015 19:49:47 GMT

I need to ingest a hpel log file produce from IBM websphere server. I need to know does splunk support this.

Any pointer is appreciable.

Regards,
Badri

Re: Does Splunk Support IBM HPEL log ingestion

m4him7 — Sat, 13 Jun 2015 02:27:56 GMT

The log needs to be plain text.
Each event needs a time stamp.
If that is true you read it in and then create field extracts with regex. You can manually do the regex or let Splunk's GUI create the regex.

I have read in logs that have unusal timestamps
June 11 2015
06:00 some event data
06:12 some event data
06:14 some event data
June 12 2015
00:05 some data
00:15 some data

I have written scripts in powershell and phython that simply reads until the date is found
then read the times and insert the date before the time
write out the newly formated event line to a new file
keep reading until a new date is found.
write new log to disk
splunk reads the new log
I have also used a script output to send the log directly to Splunk. Both are really simple to do.

topic Does Splunk Support IBM HPEL log ingestion in Getting Data In

Does Splunk Support IBM HPEL log ingestion

Re: Does Splunk Support IBM HPEL log ingestion