How to install,configure and setup Ironstream to get data into splunk from mainframe systems? ... View more

I always tell our customers to use the following parameters in their props.conf file for sourcetype=syncsortMF SHOULD_LINEMERGE = false LINE_BREAKER = \"}$ ... View more

I would strongly recommend not changing your data to influence the event listing in Splunk. Instead, make your queries smarter or use custom event renderers to do what you need. The INDEXED_VALUE=false disables Splunk's default behaviour of translating "field=value" into "look for 'value' token in lexicon, retrieve events, apply field extraction, filter for field=value" and instead makes Splunk do "retrieve all events, apply field extraction, filter for field=value". Apparently the token handling is confused by your newline, or your newline is confused by the token handling... the search filter itself works as you already discovered by piping to where . To open a support case, go to http://www.splunk.com/ and hit Support & Services -> Support Portal. Make sure you log in using an account that is registered as a support contact under your support entitlement. ... View more

IBM Common Data Provider for z Systems (CDPz) is the best option for sending Mainframe logs to Splunk. CDPz can send a wide variety of data including 140 data sources and 100+ SMF record types. More specifically, CDPz can support the following: • SMF records • SYSLOG (IBM z/OS System Log and USS SyslogD) • JOBLOGs • Application logs (IBM CICS Transaction Server logs and IBM WebSphere Application Server logs) CDPz also has advanced filtering capabilities including RegEx and time filtering that can be set up using the built-in web configuration tool shown below. More information on IBM Common Data Provider for z Systems can be found directly on Splunkbase. ... View more

The following Splunk Blog outlines how Splunk and IBM are partnering to help customers integrate IBM Z (Mainframe) Data and Insights into Splunk software: https://www.splunk.com/blog/2017/08/22/insane-in-the-mainframe-splunk-and-ibm-partner-to-provide-end-to-end-visibility-for-joint-customers.html ... View more

Many thanks for the info. Interesting tool. We have different needs to cover joblogs(job/Step termination within batch jobs), syslog,RACF, data from user exits ... data from any file etc. to b sent to any kind of syslog servers. In many cases using sort exits is the smartest way for us, as a user can filter the data as needed. ... View more