Once RACF logs have been located, where would I need to send them so that they could be sent to Splunk? In simple terms, I would assume that they would need to be sent to a Syslog server by following the below process? Also, I do not think TA's like Ironside or SFSherlock or IBM Common Data Provider for z Systems are required, or are they?
1.) Forward SMF logs from z/OS system to Syslog into their own dedicated directory
2.) On the Syslog server configure the inputs.conf/monitoring stanza to look for those SMF logs
3.) The UF that is installed on the Syslog server is configured via its outputs.conf file to forward to the IDX or HF for parsing
4.) IDX or HF (props.conf) the logs are parsed and then sent down to Splunk
