All Apps and Add-ons

Splunk Add-on for IBM WebSphere Application Server: How to configure the add-on to read from syslog server where rsyslog has forwarded the files?

Path Finder

The Websphere admin has rsyslog the files over to a syslog server. I am having issues configuring the Splunk Add-on for IBM WebSphere Application Server to pull the log files from the directory. Normally, I would just setup a monitor stanza, but this Add-on doesn't seem to like it. Any help would be appreciated.


0 Karma

Splunk Employee
Splunk Employee

@john.glasscock - Did the answer provided by goodsellt help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma


Since the addon probably is expecting the native log file lines and you're probably getting a syslog header attached to your lines, you'll likely to do something like this:
- Create a dummy sourcetype like "ibm-websphere-syslog" and monitor your rsyslog files with that.
- In the dummy sourcetype, setup a props and transforms so that it seds out the syslog header, then transforms the line to the "proper" ibm websphere sourcetype from the addon.
- Verify that your data is being properly parsed as the real sourcetype and the fields expected from the addon are appearing.

You could also redo the props.conf and transforms.conf statements to account for your syslog header and throw them in the local dir of the addon.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...