topic RACF Logs in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/RACF-Logs/m-p/546027#M9839 <P>Once RACF logs have been located, where would I need to send them so that they could be sent to Splunk?&nbsp; In simple terms, I would assume that they would need to be sent to a Syslog server by following the below process?&nbsp; Also, I do not think TA's like Ironside or SFSherlock or IBM Common Data Provider for z Systems are required, or are they?&nbsp;</P><P><SPAN>&nbsp;</SPAN>1.)&nbsp; Forward SMF logs from&nbsp;<SPAN>z/OS system to Syslog into their own dedicated directory</SPAN></P><P><SPAN>2.)&nbsp; On the Syslog server configure the inputs.conf/monitoring stanza to look for those SMF logs</SPAN></P><P><SPAN>3.)&nbsp; The UF that is installed on the Syslog server is configured via its outputs.conf file to forward to the&nbsp; IDX or HF for parsing</SPAN></P><P><SPAN>4.) IDX or HF (props.conf) the logs are parsed and then sent down to Splunk</SPAN></P> Tue, 30 Mar 2021 14:42:24 GMT itsmevic 2021-03-30T14:42:24Z RACF Logs https://community.splunk.com/t5/Splunk-Enterprise-Security/RACF-Logs/m-p/546027#M9839 <P>Once RACF logs have been located, where would I need to send them so that they could be sent to Splunk?&nbsp; In simple terms, I would assume that they would need to be sent to a Syslog server by following the below process?&nbsp; Also, I do not think TA's like Ironside or SFSherlock or IBM Common Data Provider for z Systems are required, or are they?&nbsp;</P><P><SPAN>&nbsp;</SPAN>1.)&nbsp; Forward SMF logs from&nbsp;<SPAN>z/OS system to Syslog into their own dedicated directory</SPAN></P><P><SPAN>2.)&nbsp; On the Syslog server configure the inputs.conf/monitoring stanza to look for those SMF logs</SPAN></P><P><SPAN>3.)&nbsp; The UF that is installed on the Syslog server is configured via its outputs.conf file to forward to the&nbsp; IDX or HF for parsing</SPAN></P><P><SPAN>4.) IDX or HF (props.conf) the logs are parsed and then sent down to Splunk</SPAN></P> Tue, 30 Mar 2021 14:42:24 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/RACF-Logs/m-p/546027#M9839 itsmevic 2021-03-30T14:42:24Z