About ianhss

ianhss · ‎10-14-2021

@SplunkDash Did you make any progress with this? I am interested to learn if you managed to get anything working for Unisys 2200.

ianhss · ‎08-14-2018

Hi marrette, I am happy to help and glad to hear you are using Ironstream successfully. Yes, there is metadata involved. Bottom line, this is legitimate and has no impact or overhead on your indexing. The metadata, at least for target index, is not indexed. But this is Splunk internals, hence I am not at liberty to reveal the full workings. But if you put on your lateral thinking hat and use a wire tracing tool (such as one of our own Syncsort ZEN Suite components) you will be able to see what is being sent. Happy [mainframe] Splunking!

ianhss · ‎08-14-2018

Hi marrette. No magic, all legitimate Splunk use. Splunk can use meta data for specifying the receiving index. This can be specified in the Ironstream mainframe configuration. The value will be used as a data destination, unless it is overridden in Splunk. Failing that, Splunk will send the data to the default index. Are you a licensed customer or using our free Starter Edition? If a licensed customer, and you have further questions, our Support Team will be very happy to help. Please feel free contact them via our MySypport site.

ianhss · ‎12-15-2017

Hi, Ironstream uses TCP to connect to Splunk. Hope this helps. Happy to answer any other Ironstream questions. Alternatively, contact our support team via www.syncsort.com.

ianhss · ‎10-05-2016

Hello Yasin, You need to create a new TCP data input on your Splunk server. In Splunk, select the menu option: Settings > Data inputs Create a new TCP data input, and click New. In the Add Data screen, enter a Port number. This will be used for the incoming data. In the next panel, set the SourceType to: structured > _json. And, select an index (or create a new index). Configure Ironstream to send SYSLOG data to the Splunk server using the IP address of your server and the port specified above. NOTE: Firewall or network issues may interfere with any connection. If you have any problems, please contact our Support team: https://www.syncsort.com/support . They will be very happy to help.

Posts	5
Solutions	1
Karma Given	3
Karma Received	2
Member Since	‎02-19-2015

Online Status	Offline
Date Last Visited	‎10-15-2021 08:24 AM

Re: Install UF/HF in Unisys Mainframe

Re: Syncsort Ironstream: Why does the TCP stream n...

Re: Syncsort Ironstream: Why does the TCP stream n...

Re: Splunk Applications Protocol (Layer 7)

Re: Syncsort Ironstream - SYSLOG: How can I create...