Upgrade the Splunk Add-on for IBM WebSphere Application Server

Upgrade to version 5.0.0 or later

Upgrade file monitoring settings

Previously, the add-on was creating file monitoring stanzas programmatically after asking for the IBM WAS installation directory as an input through the UI. We have removed the programmatic approach and have provided default stanzas for each sourcetype in inputs.conf for the user to use. These default stanzas will leverage the WASHOME environment variable for an IBM WAS system. Make sure that this WASHOME variable is properly configured on all the machines having IBM WAS server. E.g :

[monitor://$WASHOME\...\derby.log]

crcSalt = SOURCE

followTail = 1

sourcetype = ibm:was:derby

disabled = true

index = default

The users will have to remove their old monitoring stanzas and replace them with the new ones in order to use the field extractions provided by the add-on. Steps to do so are:

1. Take the backup of your local/inputs.conf where the file monitoring stanzas are.
2. Remove the old file monitoring stanzas.
3. Enable the desired file monitoring stanzas in the local/inputs.conf which are already provided in the default/inputs.conf of the add-on. Example, if your IBM WAS is installed on windows OS; in local/inputs.conf, write the following to enable data collection for derby logs:

[monitor://$WASHOME\...\derby.log] disabled = true

For Unix or Linux based OSs:

[monitor://$WASHOME/.../derby.log] disabled = true


Note that there are different stanzas windows and "not" windows OSs due to their different ways of specifying a path.

4. Make sure that the WASHOME environment variable is properly configured on the system. For windows OS, set the variable in System Properties -> Environment Variables -> System Variables.
5. For other unix and linux based OS, set the variable in the .profile file on your system.
6. Restart the Splunk instance after making the above changes.

Upgrade HPEL settings

Previously, the user was able to collect HPEL logs for only a single default server under a profile. In version 5.0.0, we have added support to collect HPEL logs from all servers under a WAS profile. As a result of which, the add-on will start collecting logs for all servers under the selected profiles instead of just the default one. If you want to avoid this, configure the newly added "excluded_servers" parameter in your local/ibm_was.conf under the was_hpel_settings stanza to selectively exclude servers. Please refer to the page Configure global settings, HPEL inputs, and server log inputs for more information about this parameter.

Also, the hpel_collection_enabled parameter under the was_hpel_settings stanza is deprecated from the v5.0.0 onwards. Please use the "disabled" property for the ibm_was://was_data_input stanza in inputs.conf to toggle the HPEL data collection.

Upgrade lookups

In version 5.0.0, the CSV lookup ibm_was_inventory.csv has been migrated to KV Store. Run following search on your Search heads after the upgrade to migrate the existing data to new KVStore lookup:

| inputlookup ibm_was_inventory.csv | outputlookup ibm_was_inventory

More details on how to migrate a CSV lookup to KV Store can be found here: https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/migrateyourappfromusingcsv/