Thanks For Downloading!Review the documentation below and follow any custom installation steps. If no install steps are listed, most Splunk Apps and Add-ons can be installed as follows: Windows: Decompress the downloaded file using a tool like 7-Zip and place the resulting folder into Unix/Linux: Decompress the downloaded file using a tool like DescriptionThe Splunk for WebSphere Application Server solution collects and harnesses the log, performance and configuration data to provide end to end visibility into WebSphere Application Server environments. 1. Splunk App for WebSphere Application Server contains pre-built Dashboards, classified by data type, that give you visibility into your WAS environment. Download and install this App on Splunk indexers and /or search heads. Un-compress the .tar file and install it on your Splunk indexer/search head. This is download 1 of 3 For more information, read the latest product documentation 2. Splunk Forwarder Add-on for WebSphere Application Server contains the installation scripts to automatically create your inputs.conf file. Download and install this Add-on onto a Splunk universal forwarder installed on a WAS machine to collect log and configuration data. 3. Splunk FA Add-on for WebSphere Application Server collects performance data via the JMX interface from your WebSphere environment. You can also collect configuration data using this FA Add-on. Install this FA Add-on on a remote machine that has Splunk installed. Versions and Release Notes
Version 2.0.1 (current version - updated Aug 08, 2012)
release notes:
Splunk App for WebSphere Application Server 2.0.1. Copyright (C) 2005-2012 Splunk Inc. All rights reserved. For the Release Notes see: http://docs.splunk.com/Documentation/WAS
Version 2.0.0
(updated Apr 18, 2012)
release notes:
Splunk App for WebSphere Application Server 2.0.0. Copyright (C) 2005-2012 Splunk Inc. All rights reserved. For the Release Notes see: http://docs.splunk.com/Documentation/WAS |
Links 2 and 3 for the following two downloads are broken: 2. Splunk Forwarder Add-on for WebSphere Application Server 3. Splunk FA Add-on for WebSphere Application Server
This will convert the single character event types codes in field webspherelogEventType into a new field EventType with a more meaningful definition. i.e. "F" will convert to "Fatal". Translation of WebSphere Event Types based on IBM documentation http://pic.dhe.ibm.com/infocenter/wasinfo/v6r1/index.jsp?topic=%2Fcom.ibm.websphere.express.doc%2Finfo%2Fexp%2Fae%2Frtrb_readmsglogs.html
Possibly add this to a lookup table in a future release?
index=websphere websphere_logEventType=* | eval EventType = case( websphere_logEventType == "F", "Fatal" , websphere_logEventType == "E", "Error" , websphere_logEventType == "W", "Warning" , websphere_logEventType == "I", "Info" , websphere_logEventType == "A", "Audit" , websphere_logEventType == "C", "Config" , websphere_logEventType == "O", "SysOut" , websphere_logEventType == "R", "SysErr" , websphere_logEventType == "Z", "Misc" )
Rob
This App really rocks!
In our project situation, we have multiple environments (Dev, QA, UAT etc) and would ideally like to have this enabled for all these environments. Since we have just 1 WAS App installed, we can access reports from multiple environments by using the drop-down menus for cells/clusters. This works for a short term, but becomes unwieldy and unmanageable after some when the number of environments increases (Stage, Prod, multiple data centers etc).
Is there any way/best practice to handle this situation?
My idea would be to clone the WAS App and have a seperate App for each environment. Anything which Splunk recommends?
