splunk for AS400 data input configuration issues

[remy06]

I've got our AS400 admin to extract a sample AS400 events to file(AS400) for splunk to index using the script that comes with the app.

I'm configuring data inputs to monitor the file now but the data preview gives an error:

Failed to decode 1003 bytes: source::/opt/input/AS400

The events give these unreadable characters:

\xD0\xCF\x11\x1A\xE1\x00\x00\x00\.....
\x00\x00\x1\x00\x00\x00\x00\.........

Other than that,we also tried extracting the file to a .txt format. The events showed up but some of the values isn't at the correct fields. They are being truncated and moved to incorrect fields.

[Ron_Naken]

You will need to configure your sourcetype as "dspjrn:5". Preview is a new feature of 4.3, and is not supported by the iSeries app.

As a side note, you could add the following to your $SPLUNK_HOME/etc/apps/iseries/local/props.conf:

[dspjrn:5]
pulldown_type = true

After a restart, this will allow you to use Preview, and select "dspjrn:5" in sourcetype pulldown. This will not prevent you from receiving the error; however, it will allow you to view the events, properly parsed, in the preview window.

[remy06]

I did that.I'm able to view only certain words appearing now but part of the events are still distorted and the same error message.