I don't have any experience in AS400. But, if you are able to export the logs from the mainframe with a third party app. You could use a forwarder to send the data to Splunk. If the data you get the data CIM compliant you should be able to use it in ES. In search answers there seems to be a varied amount of ways that people are using to get this data in. Good luck, Derrek ... View more