Preparing to send data to Splunk via the Data Receiver

To send data from Z Common Data Provider to Splunk, configure and run an Z Common Data Provider Data Receiver on the system where the Splunk Enterprise server or heavy forwarder is installed. In Splunk, you must also install the Z Common Data Provider Buffered Splunk Ingestion App.

In preparation for sending data to Splunk, complete the following steps:

1. Configure the Data Receiver, as described in Configuring the Data Receiver.
   Important: The Data Receiver working directory and output directory must also be available to Splunk. If you want to set these directories as environment variables, verify that the Data Receiver working directory is assigned to the environment variable CDPDR_HOME, and that the Data Receiver output directory is assigned to the environment variable CDPDR_PATH, as described in Setting up a working directory and an output directory for the Data Receiver. If you do not want to change your system environment variables, you can specify CDPDR_HOME and CDPDR_PATH in SPLUNK_HOME/etc/splunk-launch.conf.
2. Start the Data Receiver, as described in Running the Data Receiver.
3. Define a policy with the Data Receiver as the subscriber.
4. From the product's or suite's installation directory, download the Splunk Ingestion App in binary mode.
   The following files contain different versions of the App based on the intended platform on which Splunk runs.

   Table 1. Downloading the Splunk Ingestion App in binary mode

   Platform on which Splunk runs	File name for Buffered Splunk Ingestion App
   UNIX	ibm_cdpz_buffer_nix.spl
   Windows	ibm_cdpz_buffer_win.spl
   Cloud	ibm_cdpz_buffer_cloud.spl

5. To install the Buffered Splunk Ingestion App in Splunk, complete the following steps:
   1. Log in to Splunk.
   2. Click the gear icon that is next to the word Apps.
   3. Select Install app from file.
   4. Browse for the file that you downloaded in step 4, and select that file.
   5. When you are prompted, select Enable now.
   Important: If you are sending data to Splunk Cloud via the Data Receiver, you must first install ibm_cdpz_buffer_nix.spl or ibm_cdpz_buffer_win.spl on the forwarder where the Data Receiver is installed, and then install ibm_cdpz_buffer_cloud.spl on the Splunk Cloud instance.

   If you are using a Splunk heavy forwarder, you do not have to index the data locally. You can use the system, sysplex, and host attributes to route the data to an appropriate indexer.

   If you want to split the indexing locally, you can refine the monitor stanzas in the inputs.conf file by extending them to add the sysplex component of the file name. Then, duplicate the monitor stanza for each sysplex from which you want to ingest data, and change the index value on the monitor stanzas to indicate the index in which the data is to be kept. These indexes must be created within Splunk. If you update the Z Common Data Provider Buffered Splunk Ingestion App, this customization is deleted.

index=zosdex sourcetype=zOS-SYSLOG-Console

index=zosdex sysplex=PRODPLEX jobname=CICS35 sourcetype=zOS-SYSLOG-Console