Install the Splunk Forwarder Add-on
Install the Splunk Forwarder Add-on
You now have the latest version of the Splunk Forwarder Add-on for WebSphere Application Server (WAS),
splunk_forwarder_addon_was_<build number>.tar.gz available on your network. You can install it on the Splunk forwarders on your WAS machines. Note: If you have not already downloaded the Add-on, see "Download Splunk for WAS" for download instructions.
Before installing the Splunk Forwarder Add-on you must meet the prerequisites.
- WAS ND version 6.0 or higher is installed on the WAS machines identified as being part of the Splunk environment.
- A Splunk forwarder version 4.2 or later is installed on each WAS machine from which you intend to collect log and config data. We recommend that at a minimum you install a Splunk forwarder on the machines where your WAS Deployment Managers reside.
Install the Splunk Forwarder Add-on for WAS
Important: You must install the Splunk Forwarder Add-on for WAS on the Splunk forwarder on the WAS Deployment manager for the application to work. Additionally, install this Add-on on the Splunk forwarders on each WAS App server machine from which you want to collect log data.
To install the Splunk Forwarder Add-on for WAS on your forwarder:
- STOP the Splunk forwarder before you start the installation.
- Unpack the
tar.gzfile directly onto the
$SPLUNK_HOME/etc/appsdirectory on a Splunk forwarder installed on a WAS machine.
- On Linux, use the commands
sudo gunzip <filename>.tar.gz
sudo tar -xvf <filename>.tar
- On Windows, download a third party tool (such as WinRAR) to unpack a
tar.gzfile on windows.To download WinRAR go to http://www.rarlab.com/download.htm.
- Create a
Collect your environment variables
The Splunk Forwarder Add-on for WAS contains a Java based tool,
CreateInputs.jar, that you can run to automatically create the
inputs.conf file. To learn more about this tool, see CreateInputs.jar in the chapter Installation Tools in this manual. To run the command line tool you must know your environment variables.
To collect your environment variables:
- Read the requirements to run the tool, noted in this manual.
- Login as root or use sudo to run the commands.
- Select the Java version that you want to use. You can use the Java version included with WebSphere, located in
/opt/IBM/WebSphere/AppServer/java/bin/javaor any installed Java version.
- Find the profile directory of your WAS installation on this machine, for example
- Get the correct host name for the machine from the
serverindex.xmlfile stored under any profile. It must be of the format that WebSphere uses to store it. For example, you can find it in
In the example below, the host name is
<?xml version="1.0" encoding="UTF-8"?>
.... xmi:id="ServerIndex_1" hostName="splunkwas" ....
Automatically create inputs.conf
You can create the
inputs.conf file automatically using the Java command line tool
CreateInputs.jar. If you have an older version of the
inputs.conf file, you can override it or create a new file.
inputs.conf is created in
Note: CreateInputs.jar only looks for logs stored within the default WebSphere directory structure. If you store your logs outside the default location, then you must specify the location of the log files.
The following examples show how you can run the tool to automatically crete your
inputs.conf file. You can read a description of each of the parameters in the Parameter table in Installation tools in this manual.
- To collect data from standard App Server profiles and only one deployment manager profile, use:
java -jar CreateInputs.jar -startpath /opt/IBM/WebSphere80ND/AppServer/profiles/ -hostname MyHost -enablenodemetadata -whitelist '\.log$|\.txt$' -dmgrprofile Dmgr01
- To collect data from Deployment Manager and App Server profiles:
java -jar CreateInputs.jar -startpath /opt/IBM/WebSphere80ND/AppServer/profiles/ -hostname MyHost -enablenodemetadata -whitelist '\.log$|\.txt$' -dmgrprofile Dmgr01,Dmgr02
- To collect data from Deployment Manager profiles only:
java -jar CreateInputs.jar -startpath /opt/IBM/WebSphere80ND/AppServer/profiles/ -hostname MyHost -enablenodemetadata -whitelist '\.log$|\.txt$' -alldmgrprofile
- To collect logs stored outside of WebSphere's default directory structure:
java -jar CreateInputs.jar -startpath /opt/IBM/WebSphere80ND/AppServer/profiles/ -hostname MyHost -whitelist '\.log$|\.txt$' -alldmgrprofile -logpath /dev1/WAS7/logs,dev2/WAS8/logs
Installing on WAS ND 6.0
fileRegistry.xml does not exist in WAS 6.0. To populate the User Inventory view in the Splunk App for WAS you must have this file. Therefore, the view is not populated when you install on WAS ND 6.0.
Note: Remember to include the parameter
You now have your Splunk Forwarder Add-on for WAS installed and ready to index and forward WAS log and config data. Now you can verify your
inputs.conf file and then start Splunk.
Manually create inputs.conf
We have included a sample
inputs.conf file in the Configuration File Reference section of this manual. You can use this as a template to manually create your own
You can add these
inputs.conf stanzas either to the Splunk Forwarder Add-on for WAS' local
inputs.conf file in
$SPLUNK_HOME/etc/system/local/inputs.conf, or any other
inputs.conf on your Splunk Forwarder Add-on for WAS .
This documentation applies to the following versions of WAS: 2.0.1