Install the Splunk Forwarder Add-on

Install the Splunk Forwarder Add-on

You now have the latest version of the Splunk Forwarder Add-on for WebSphere Application Server (WAS), splunk_forwarder_addon_was_<build number>.tar.gz available on your network. You can install it on the Splunk forwarders on your WAS machines. Note: If you have not already downloaded the Add-on, see "Download Splunk for WAS" for download instructions.

Before installing the Splunk Forwarder Add-on you must meet the prerequisites.

Prerequisites

• WAS ND version 6.0 or higher is installed on the WAS machines identified as being part of the Splunk environment.
• A Splunk forwarder version 4.2 or later is installed on each WAS machine from which you intend to collect log and config data. We recommend that at a minimum you install a Splunk forwarder on the machines where your WAS Deployment Managers reside.

Install the Splunk Forwarder Add-on for WAS

Important: You must install the Splunk Forwarder Add-on for WAS on the Splunk forwarder on the WAS Deployment manager for the application to work. Additionally, install this Add-on on the Splunk forwarders on each WAS App server machine from which you want to collect log data.

To install the Splunk Forwarder Add-on for WAS on your forwarder:

1. STOP the Splunk forwarder before you start the installation.
2. Unpack the tar.gz file directly onto the $SPLUNK_HOME/etc/apps directory on a Splunk forwarder installed on a WAS machine.

   On Linux, use the commands

   sudo gunzip <filename>.tar.gz

   sudo tar -xvf <filename>.tar

   On Windows, download a third party tool (such as WinRAR) to unpack a tar.gz file on windows.To download WinRAR go to http://www.rarlab.com/download.htm.

3. Create a /local directory in $SPLUNK_HOME/etc/apps/splunk_forwarder_addon_was.

Collect your environment variables

The Splunk Forwarder Add-on for WAS contains a Java based tool, CreateInputs.jar, that you can run to automatically create the inputs.conf file. To learn more about this tool, see CreateInputs.jar in the chapter Installation Tools in this manual. To run the command line tool you must know your environment variables.

To collect your environment variables:

1. Read the requirements to run the tool, noted in this manual.
2. Login as root or use sudo to run the commands.
3. Select the Java version that you want to use. You can use the Java version included with WebSphere, located in /opt/IBM/WebSphere/AppServer/java/bin/java or any installed Java version.
4. Find the profile directory of your WAS installation on this machine, for example /opt/IBM/WebSphere/AppServer/profiles .
5. Get the correct host name for the machine from the serverindex.xml file stored under any profile. It must be of the format that WebSphere uses to store it. For example, you can find it in

/opt/IBM/WebSphere/AppServer/profiles/Dmgr01/config/cells/splunkwasCell01/nodes/splunkwasCellManager01/serverindex.xml

In the example below, the host name is splunkwas.

<?xml version="1.0" encoding="UTF-8"?>

.... xmi:id="ServerIndex_1" hostName="splunkwas" ....

Automatically create inputs.conf

You can create the inputs.conf file automatically using the Java command line tool CreateInputs.jar. If you have an older version of the inputs.conf file, you can override it or create a new file. inputs.conf is created in $SPLUNK_HOME/etc/apps/splunk_forwarder_addon_was/local.

Note: CreateInputs.jar only looks for logs stored within the default WebSphere directory structure. If you store your logs outside the default location, then you must specify the location of the log files.

The following examples show how you can run the tool to automatically crete your inputs.conf file. You can read a description of each of the parameters in the Parameter table in Installation tools in this manual.

• To collect data from standard App Server profiles and only one deployment manager profile, use:

java -jar CreateInputs.jar -startpath /opt/IBM/WebSphere80ND/AppServer/profiles/  -hostname MyHost  -enablenodemetadata -whitelist '\.log$|\.txt$'  -dmgrprofile Dmgr01

• To collect data from Deployment Manager and App Server profiles:

java -jar CreateInputs.jar -startpath /opt/IBM/WebSphere80ND/AppServer/profiles/  -hostname MyHost -enablenodemetadata -whitelist '\.log$|\.txt$' -dmgrprofile Dmgr01,Dmgr02

• To collect data from Deployment Manager profiles only:

java -jar CreateInputs.jar -startpath /opt/IBM/WebSphere80ND/AppServer/profiles/  -hostname MyHost -enablenodemetadata -whitelist '\.log$|\.txt$' -alldmgrprofile

• To collect logs stored outside of WebSphere's default directory structure:

java -jar CreateInputs.jar -startpath /opt/IBM/WebSphere80ND/AppServer/profiles/ -hostname MyHost -whitelist '\.log$|\.txt$' -alldmgrprofile -logpath /dev1/WAS7/logs,dev2/WAS8/logs 

Installing on WAS ND 6.0

fileRegistry.xml does not exist in WAS 6.0. To populate the User Inventory view in the Splunk App for WAS you must have this file. Therefore, the view is not populated when you install on WAS ND 6.0.
Note: Remember to include the parameter -was6.

Start Splunk

You now have your Splunk Forwarder Add-on for WAS installed and ready to index and forward WAS log and config data. Now you can verify your inputs.conf file and then start Splunk.

Manually create inputs.conf

We have included a sample inputs.conf file in the Configuration File Reference section of this manual. You can use this as a template to manually create your own inputs.conf file.

You can add these inputs.conf stanzas either to the Splunk Forwarder Add-on for WAS' local inputs.conf file in $SPLUNK_HOME/etc/system/local/inputs.conf, or any other inputs.conf on your Splunk Forwarder Add-on for WAS .

• Was this topic useful?
• Post a comment