Hello,
We are trying to monitor certain events that are user generated and can either be placed in the zOS Syslog, which is forwarded to Splunk via the CDP Syslog Forwarder for zOS, or in a sequential file.
On on a performance matrix, should we use syslog queries (which would run on the whole syslog sourcetype), or define a new sourcetype as the file that will be forwarded to a listener on the CDP remote server?
Will the queries run longer and be more demanding on the Splunk server?
Thanks in advanced.
