Splunk® Supported Add-ons

Splunk Add-on for IBM WebSphere Application Server

Configure monitor inputs for the gc.log and serverindex.xml logs

If you plan to use the Splunk Add-on for IBM WebSphere Application Server with IT Service Intelligence (ITSI), you need to create inputs for the gc.log and serverindex.xml logs. Although you can use the setup page to generate inputs for most of the local server logs, you must manually create monitor inputs for the gc.log and serverindex.xml logs. You can use either Splunk Web to create the monitor inputs or configure inputs.conf directly.

Configure Monitoring through Splunk Web

Configure file monitoring inputs on your data collection node for the gc.log and serverindex.xml logs.

1. Log into Splunk Web.

2. Select Settings > Data inputs > Files & directories.

3. Click New.

4. Click Browse next to the File or Directory field.

5. Navigate to directory of your gc.log, and click Next.

6. In the Sourcetype field, select ibm:was:gcLog, and click Next.

7. Click Review.

8. After you review the information, click Submit.

9. Repeat the steps above for the serverindex.xml and assign a source type of ibm:was:serverIndex.

Configure inputs.conf

You can configure the monitor inputs in the inputs.conf file instead of using Splunk Web. After setting up the add-on, using either the setup page or using the configuration files and running the python script, a local/inputs.conf file gets generated for you. Edit this file to add the file monitor inputs.

1. Using a text editor, open the $SPLUNK_HOME/etc/apps/Splunk_TA_ibm-was/local/inputs.conf file.

2. Add the following stanzas and lines, replacing <server_name>, <cell_name>, and <node_name> with the appropriate values for your environment, and save the file:

[monitor:///opt/IBM/WebSphere/AppServer/profiles/AppSrv01/logs/<server_name>/gc.log]
sourcetype = ibm:was:gcLog
disabled = 0

[monitor:///opt/IBM/WebSphere/AppServer/profiles/AppSrv01/config/cells/$<cell_name>/nodes/$<node_name>/serverindex.xml]
sourcetype = ibm:was:serverIndex
disabled = 0

3. Restart the Splunk platform in order for the new inputs to take effect.

Validate inputs for gc.log and serverindex.xml

After you configure monitoring, verify that data from the two sources is being ingested into the Splunk platform by using the following search commands and verifying that one or more events is returned.

sourcetype=ibm:was:gcLog

sourcetype=ibm:was:serverIndex

Last modified on 07 October, 2021
 

This documentation applies to the following versions of Splunk® Supported Add-ons: released, released


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters