Skip to main content

SMF Processing Overview

SMF processing reads SMF records, processes the information and sends it to Splunk using the HTTP Event Collector (HEC).

There are 3 separate aspects to the SMF processing:

Individual Records​

Many records are processed immediately and sent to Splunk.

Interval Processing​

Some data is accumulated and sent at the end of an interval, similar to the system RMF and SMF interval.

Set the interval as required. You can set the interval to match your SMF interval, or make it shorter e.g. 5 minutes or 1 minute for more granular data.

End of Minute Processing​

Some data is accumuated and sent at the end of each minute.

Splitting Processing​

Different records can be processed by different jobs or STCs. This allows you to track usage for the processing of different record types, but will result in slightly higher processing overhead.

TCP/IP type 119 records should be available to the job processing RACF records, in order to fill in IP address information from the RACF terminal.

RACF Deduplication​

RACF can produce many records containing the same data. RACF Processing performs intelligent deduplication to reduce the amount of data sent to Splunk.

Duplicates are detected based on identical record content, excluding the record date and time.

For duplicate records:

  • the first record is always sent immediately
  • the second record is sent immediately so you can detect repeated events
  • after that, duplicate record information with the repeat count is sent at increasing intervals, up to every 1000 records for very high volume events
  • the repeated record information is flushed at 1 minute intervals, so in normal processing information will not be delayed more than approximately 1 minute