Splunk has graciously included the websphere_trlog_sysout and websphere_trlog_syserr source types out of the box. They seem to handle the log entries very well.
However, due to the way IBM writes out these logs when they get rolled, you will also need to include the following line in your inputs.conf for your WAS logs:
crcSalt = <SOURCE>
Otherwise, Splunk will think it has already processed the log and ignore the new ones WebSphere AppServer creates. The… Continue
Posted on October 2, 2009 at 12:00pm