I am not sure if this is a suggestion or already a solution. If the later I would very much like to see the more detailed explanation. I need to configure univ forwarders across number of cells and i need a flexible scriptable way of directing the inputs app to which index to send the data. Will macro work on UF 5.x. Thanks! ... View more

We use the following command on both nodes and dmgr hosts. As you see we use WAS own JVM and we do substitution right away to put custom index name. Blacklist section helps us weed out rolled over logs. SPLUNK_ADDON_DIR=${SPLUNK_CONFIGS:?}/splunk_forwarder_addon_was INDEX_NAME=ind_${PROD:?}_${APP_NAME:?}_${ENVID:?}_app if [[ -d "/opt/IBM/BPM751/WebSphere/AppServer/profiles/" ]] ; then /opt/IBM/BPM751/WebSphere/AppServer/java/bin/java \ -jar $SPLUNK_ADDON_DIR/bin/CreateInputs.jar \ -startpath /opt/IBM/BPM751/WebSphere/AppServer/profiles/ \ -hostname $(hostname) \ -enablenodemetadata -whitelist '\.log$|\.txt$|\.out$' \ -blacklist 'native_stderr|trace|(SystemErr_|SystemOut_|native_stdout_)[0-9][0-9]\.[0-9][0-9]\.[0-9][0-9]_[0-9][0-9]\.[0-9][0-9]\.[0-9][0-9]\.log$' \ -alldmgrprofile \ -print | sed -e 's/index \= websphere/index = '$INDEX_NAME'/g' > $OUT_FILE fi ... View more