All Apps and Add-ons

splunk for AS400 data input configuration issues

remy06
Contributor

I've got our AS400 admin to extract a sample AS400 events to file(AS400) for splunk to index using the script that comes with the app.

I'm configuring data inputs to monitor the file now but the data preview gives an error:

Failed to decode 1003 bytes: source::/opt/input/AS400

The events give these unreadable characters:

\xD0\xCF\x11\x1A\xE1\x00\x00\x00\.....
\x00\x00\x1\x00\x00\x00\x00\.........

Other than that,we also tried extracting the file to a .txt format. The events showed up but some of the values isn't at the correct fields. They are being truncated and moved to incorrect fields.

0 Karma

Ron_Naken
Splunk Employee
Splunk Employee

You will need to configure your sourcetype as "dspjrn:5". Preview is a new feature of 4.3, and is not supported by the iSeries app.

As a side note, you could add the following to your $SPLUNK_HOME/etc/apps/iseries/local/props.conf:

[dspjrn:5]
pulldown_type = true

After a restart, this will allow you to use Preview, and select "dspjrn:5" in sourcetype pulldown. This will not prevent you from receiving the error; however, it will allow you to view the events, properly parsed, in the preview window.

0 Karma

remy06
Contributor

I did that.I'm able to view only certain words appearing now but part of the events are still distorted and the same error message.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!