Upgrade the Splunk Add-on for IBM WebSphere Application Server
Upgrade to version 5.0.0 or later
Upgrade file monitoring settings
Previously, the add-on was creating file monitoring stanzas programmatically after asking for the IBM WAS installation directory as an input through the UI. We have removed the programmatic approach and have provided default stanzas for each sourcetype in inputs.conf for the user to use. These default stanzas will leverage the WASHOME environment variable for an IBM WAS system. Make sure that this WASHOME variable is properly configured on all the machines having IBM WAS server. E.g :
[monitor://$WASHOME\...\derby.log]
crcSalt = SOURCE
followTail = 1
sourcetype = ibm:was:derby
disabled = true
index = default
The users will have to remove their old monitoring stanzas and replace them with the new ones in order to use the field extractions provided by the add-on. Steps to do so are:
- Take the backup of your local/inputs.conf where the file monitoring stanzas are.
- Remove the old file monitoring stanzas.
- Enable the desired file monitoring stanzas in the local/inputs.conf which are already provided in the default/inputs.conf of the add-on. Example, if your IBM WAS is installed on windows OS; in local/inputs.conf, write the following to enable data collection for derby logs:
- Make sure that the WASHOME environment variable is properly configured on the system. For windows OS, set the variable in System Properties -> Environment Variables -> System Variables.
- For other unix and linux based OS, set the variable in the .profile file on your system.
- Restart the Splunk instance after making the above changes.
[monitor://$WASHOME\...\derby.log]
disabled = true
For Unix or Linux based OSs:
[monitor://$WASHOME/.../derby.log]
disabled = true
Note that there are different stanzas windows and "not" windows OSs due to their different ways of specifying a path.
Upgrade HPEL settings
Previously, the user was able to collect HPEL logs for only a single default server under a profile. In version 5.0.0, we have added support to collect HPEL logs from all servers under a WAS profile. As a result of which, the add-on will start collecting logs for all servers under the selected profiles instead of just the default one. If you want to avoid this, configure the newly added "excluded_servers" parameter in your local/ibm_was.conf under the was_hpel_settings stanza to selectively exclude servers. Please refer to the page Configure global settings, HPEL inputs, and server log inputs for more information about this parameter.
Also, the hpel_collection_enabled
parameter under the was_hpel_settings
stanza is deprecated from the v5.0.0 onwards. Please use the "disabled" property for the ibm_was://was_data_input
stanza in inputs.conf to toggle the HPEL data collection.
Upgrade lookups
In version 5.0.0, the CSV lookup ibm_was_inventory.csv has been migrated to KV Store. Run following search on your Search heads after the upgrade to migrate the existing data to new KVStore lookup:
| inputlookup ibm_was_inventory.csv | outputlookup ibm_was_inventory
More details on how to migrate a CSV lookup to KV Store can be found here: https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/migrateyourappfromusingcsv/
Install the Splunk Add-on for IBM WebSphere Application Server | Configure IBM WebSphere to produce data for the Splunk Add-on for IBM WebSphere Application Server |
This documentation applies to the following versions of Splunk® Supported Add-ons: released
Feedback submitted, thanks!