SMF Processing
In this section
You have several different options to send data to Splunk.
They all use the same program and send the data to the Splunk HTTP Event Collector (HEC) but differ in where they run and how the data is accessed.
Options are:
z/OS SMF Real Time Interface
Read data as it is written from the z/OS SMF Real Time Interface. Data is sent to Splunk in real time, typically within a few seconds of the record being written. The z/OS SMF Real Time interface is RACF protected and does NOT require APF authorization or exits.
Prerequites:
- SMF must be running in logstream mode.
z/OS Batch Job
Send the data to Splunk using a z/OS batch job as part of your regular SMF processing. The batch job can run as frequently as required. It processes data from the SMF dump datasets.
Off mainframe, using the z/OSMF Dataset and Files REST API to access the data.
The program can run on any Java system and use z/OSMF to read the data over a https connection.
Off mainframe, transferring the data using some other process
The program can run on any Java system and process data already downloaded to a file on that system. Data can be transferred using e.g. FTP or Zowe CLI. This is the least preferred option because transferring the data correctly often causes problems. Data must be transferred with record lengths intact, either in RDW format as used by FTP or record format as used by z/OSMF and Zowe.
Summary
| Option | Real Time Data | On Mainframe | Requires Mainframe Access |
|---|---|---|---|
| SMF Real Time Interface | Yes | Yes | Yes |
| z/OS Batch | No | Yes | Yes |
| z/OSMF REST API | No | No | Yes, using z/OSMF Dataset and Files REST API |
| Manual Download | No | No | No |