Can Splunk process Oracle Siebel [SARM/FDR] files?

[ludwigb3]

We use Oracle a lot, and there is interest in the Siebel SARM & FDR logs. There are read with two different siebel applications called “sarmquery” and “sarmanalyzer.” "The output can be formatted by way of flags, and is usually exported as csv. It is then opened in Excel for interpretation."

[Nagasai]

When an end user clicks a view tab to navigate to a new view, a chain of processes is invoked on different machines in order to handle the request. For example, the Siebel Web Server Extension must connect to the application object manager (AOM) on the Siebel server. The AOM will issue an SQL statement to the Siebel database and the Siebel Web Engine (SWE) will put the view layout and data together and render the view.

In order to be able to make exact measurements to determine performance bottlenecks quickly, Siebel engineers have included instrumentation points in the core program code of all Siebel software components.

[yannK]

Yes, splunk is able to index csv files.

In order to index data, splunk need :

• read access to the logs files
• a sourcetype configure to parse the events properly (find the timestamp, parse events, parse fields in csv)

see http://docs.splunk.com/Documentation/Splunk/latest/Data/Handleeventtimestamps
http://docs.splunk.com/Documentation/Splunk/latest/Data/Overviewofdefaultfieldextraction
http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime

Please try to index your csv files with a free version, and test different parsing rules.