How to add web sphere logs into Splunk Websphere App

[TimothyPeh]

I am currently doing a POC where I want to index 1 websphere log file on my local host onto the Splunk app and see what kind of analysis can I do. However, I cannot find the option to upload to the app.

I can upload it generically to the search app but not to the Websphere App.

[okrabbe_splunk]

If you just want to locally index one file you should be able to just set the index = websphere and as long as you did not rename the file it should automatically detect the sourcetype.

One thing I would recommend is to look at the file $SPLUNK_HOME/etc/apps/splunk_for_was/defaults/props.conf and take a look at how Splunk is determining sourcetypes. You will see it is matching source names and then setting a sourcetype. Further settings are then applied based on those sourcetypes. By having the correct index, sourcetypes, and field extractions this makes the dashboards in the WAS application work correctly.

If this is all very confusing to you I might recommend then taking a step back and reading through the install guide for the WAS application.

http://docs.splunk.com/Documentation/WAS/latest/InstallGuide/

Hope this helps.