HCL Domino and Notes

[gillettepd]

Can Splunk ingest log data from HCL Domino and Notes?

[tscroggins]

@gillettepd 

I've not used or written code (in C) for Domino since it was still a Lotus product. During IBM's tenure, JDBC Access for IBM Lotus Domino <https://www.openntf.org/main.nsf/project.xsp?r=project/JDBC%20Access%20for%20IBM%20Lotus%20Domino> may have been a viable option for querying LOG.NSF, DOMLOG.NSF, etc. using Splunk DB Connect. The JDBC solution may work with HCL Domino 11.x, but a quick search suggests it will not work with 12.x. The JDBC driver may also be incompatible with DB Connect, depending on its implementation of expected JDBC interfaces. That said, give it a try!

I would evaluate OData access <https://opensource.hcltechsw.com/Domino-rest-api/tutorial/odata/index.html>; however, there is no OData add-on for Splunk. If you're comfortable with Python, REST API Modular Input <https://splunkbase.splunk.com/app/1546> is a (mostly) fee-based add-on that may simplify writing an OData wrapper. Splunk Add-on Builder <https://splunkbase.splunk.com/app/2962> is always an option, but it exposes the Splunk API in a way that may complicate your solution.

[richgalloway]

If it's text then Splunk can ingest it.  How to ingest it is another matter.

There are a few ways to onboard data into Splunk.

• Install a universal forwarder on the server to send log files to Splunk
• Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog
• Use the server's API to extract data for indexing
• Use Splunk DB Connect to pull data from the server's SQL database.
• Have the application send data directly to Splunk using HTTP Event Collector (HEC).