Configure monitor inputs for the gc.log and serverindex.xml logs

If you plan to use the Splunk Add-on for IBM WebSphere Application Server with IT Service Intelligence (ITSI), you need to create inputs for the gc.log and serverindex.xml logs. Although you can use the setup page to generate inputs for most of the local server logs, you must manually create monitor inputs for the gc.log and serverindex.xml logs. You can use either Splunk Web to create the monitor inputs or configure inputs.conf directly.

Configure Monitoring through Splunk Web

Configure file monitoring inputs on your data collection node for the gc.log and serverindex.xml logs.

1. Log into Splunk Web.

2. Select Settings > Data inputs > Files & directories.

3. Click New.

4. Click Browse next to the File or Directory field.

5. Navigate to directory of your gc.log, and click Next.

6. In the Sourcetype field, select ibm:was:gcLog, and click Next.

7. Click Review.

8. After you review the information, click Submit.

9. Repeat the steps above for the serverindex.xml and assign a source type of ibm:was:serverIndex.

Configure inputs.conf

You can configure the monitor inputs in the inputs.conf file instead of using Splunk Web. After setting up the add-on, using either the setup page or using the configuration files and running the python script, a local/inputs.conf file gets generated for you. Edit this file to add the file monitor inputs.

1. Using a text editor, open the $SPLUNK_HOME/etc/apps/Splunk_TA_ibm-was/local/inputs.conf file.

2. Add the following stanzas and lines, replacing <server_name>, <cell_name>, and <node_name> with the appropriate values for your environment, and save the file:

[monitor:///opt/IBM/WebSphere/AppServer/profiles/AppSrv01/logs/<server_name>/gc.log]
sourcetype = ibm:was:gcLog
disabled = 0

[monitor:///opt/IBM/WebSphere/AppServer/profiles/AppSrv01/config/cells/$<cell_name>/nodes/$<node_name>/serverindex.xml]
sourcetype = ibm:was:serverIndex
disabled = 0

3. Restart the Splunk platform in order for the new inputs to take effect.

Validate inputs for gc.log and serverindex.xml

After you configure monitoring, verify that data from the two sources is being ingested into the Splunk platform by using the following search commands and verifying that one or more events is returned.

sourcetype=ibm:was:gcLog

sourcetype=ibm:was:serverIndex