https://community.splunk.com/t5/Getting-Data-In/AS400-third-party-agent-for-forwarding-data-to-splunk/m-p/420723#M99315 <P>Hello, I need to forwards logs from AS400 into splunk instance. The best option to do that is through the third-party agent, as I investigated on internet and other questions in splunkbase. My question is: Do you have any experiences with third-party agent running on AS400 and forwarding data into splunk instance? And can you investigate the incoming events in Enterprise Security app since it's CEF structured? </P> <P>(I found few of agents such as Enforcive Enterprise Security Suite, iSecurity SYSLOG (SEA), Powertech SIEM Agent for IBM i, PowerSC Syslog Reporting Manager)</P> <P>Thank you for answers or recommends for tested agents.</P> Thu, 01 Aug 2019 13:10:55 GMT matula_sands 2019-08-01T13:10:55Z https://community.splunk.com/t5/Getting-Data-In/AS400-third-party-agent-for-forwarding-data-to-splunk/m-p/420723#M99315 <P>Hello, I need to forwards logs from AS400 into splunk instance. The best option to do that is through the third-party agent, as I investigated on internet and other questions in splunkbase. My question is: Do you have any experiences with third-party agent running on AS400 and forwarding data into splunk instance? And can you investigate the incoming events in Enterprise Security app since it's CEF structured? </P> <P>(I found few of agents such as Enforcive Enterprise Security Suite, iSecurity SYSLOG (SEA), Powertech SIEM Agent for IBM i, PowerSC Syslog Reporting Manager)</P> <P>Thank you for answers or recommends for tested agents.</P> Thu, 01 Aug 2019 13:10:55 GMT https://community.splunk.com/t5/Getting-Data-In/AS400-third-party-agent-for-forwarding-data-to-splunk/m-p/420723#M99315 matula_sands 2019-08-01T13:10:55Z https://community.splunk.com/t5/Getting-Data-In/AS400-third-party-agent-for-forwarding-data-to-splunk/m-p/420724#M99316 <P>I don't have any experience in AS400. But, if you are able to export the logs from the mainframe with a third party app. You could use a forwarder to send the data to Splunk. If the data you get the data CIM compliant you should be able to use it in ES. </P> <P>In search answers there seems to be a varied amount of ways that people are using to get this data in. </P> <P>Good luck,<BR /> Derrek</P> Fri, 25 Oct 2019 19:49:53 GMT https://community.splunk.com/t5/Getting-Data-In/AS400-third-party-agent-for-forwarding-data-to-splunk/m-p/420724#M99316 kgderrekchapin 2019-10-25T19:49:53Z