We use Splunk, and I do know that our SystemOut logs are forwarded to the Splunk indexer. Does anyone have some example SPLs for searching indexes for WebSphere SystemOut Warnings "W" and SystemOut Errors "E"? Thanks.   For your reference, here is a link to IBM's WebSphere log interpretation: ibm.com/docs/en/was/8.5.5?topic=SSEQTP_8.5.5/… ... View more

I am a new Splunk user. I have finished all the Splunk Admin training. (Splunk Fundamentals 1 & 2, Splunk Administration, and Splunk Data Administration) I am still processing all the information. However, I've been tasked with developing a migration plan to move our current environment from Splunk 6.6.0 to Splunk 7.2.1. A fairly large task for a new Splunk user. I'm excited about it, and not afraid to take on the task. So just need some help in getting pointed in the right direction. For security reasons, I can't give out to any details, but I'll include what I can. Splunk 6.6.0 environment: 1-Windows 2008 Deployment Server: --serverclass.conf file location and deployment clients 1-Windows 2008 Index Controller Server: --Serves as the main index controller and license manager, where all non neteng users log in to search ingested data. 1-Linux OS Traffic Indexer --Neteng syslog traffic indexer 2 Linux OS Lightweight Forwarders --Running syslog-ng, the original syslogs from network devices get pushed to the indexers from here I think. 1-Windows Server 2008 Search Head --Searches the neteng data --All neteng users login here to search neteng data What I need to gather from what I know: A complete list of the servers from the "white-list" and "blacklist" (I think I can get this from the\Program Files\Splunk\etc\system\local\serverclass.conf file. Just not sure if it is the complete list.) File types and their paths that are being monitored on these servers (From the deployment server "Settings" > "Data Inputs" > "Forwarded Inputs"??? Is there an export function for this?) User data including alerts, reports, and dashboards. Need to know the owners of each.(Need to know how to export this, and then import to the new environment) Is the user data private or global? (Not sure where to get this from) Improve the efficiency of the saved searches and reports (This is something we can work on here. Is there a search analyzer in Splunk?) Who has access to the apps? (Group description + matching AD group) (Is there a way to compare the AD list against the Splunk users? I need to create a spreadsheet of the users, their Splunk roles, and the AD group they belong to. Is there an export function of user roles?) Index data migration (Index information - "Settings" > "Indexes". Is there a migration plan for moving indexes from one environment to the other?) Once all data is gathered, our goal is to ensure that users aren't having to straddle both environments to access their content. So, this means migrating a group with their index, and migrating the searches, reports, and alerts for that index. If anyone has a basic migration project plan, it would be helpful for the newbie. Thanks for your help. ... View more