Operating the Real Time Agent

Start the agent

To start the agent:

S EASYSMF

At startup EasySMF will test the connection to Splunk and verify that the required indexes are available and writable.

You should see:

[main] INFO EasySMF:Events - SMM0010I Connecting to HEC...          
[main] INFO EasySMF:Events - SMM0011I Splunk reports: HEC is healthy
[main] INFO EasySMF:Events - SMM0001I IFASMF.EASYSMF Connected

in the started task log.

Stop the agent

STOP EASYSMF

EasySMF will disconnect from the in-memory resource, write any pending information to Splunk, and exit.

Query status

EasySMF can report the number of records processed by type and subtype in the last minute, 5 minutes and 1 hour. Use the command:

MODIFY EASYSMF,APPL=REPORT

Output:

BPXM023I (EASYSMFU) Last Minute                                 
BPXM023I (EASYSMFU)  Type  Subtype  Records     MB    Pct    Avg
BPXM023I (EASYSMFU)    14                 1      0    0.3    432
BPXM023I (EASYSMFU)    15                 1      0    0.3    432
BPXM023I (EASYSMFU)    30        2        1      0    3.3   5436
BPXM023I (EASYSMFU)    32        3        1      0    0.2    268
BPXM023I (EASYSMFU)    40                 1      0    0.0     74
BPXM023I (EASYSMFU)    42        6        4      0    9.2   3798
BPXM023I (EASYSMFU)    42       24        1      0    0.2    270
BPXM023I (EASYSMFU)    42       27        1      0    0.2    396
BPXM023I (EASYSMFU)    92       16        1      0    0.1    212
BPXM023I (EASYSMFU)    98        1        8      0   80.5  16633
BPXM023I (EASYSMFU)    98        3        8      0    5.6   1167
BPXM023I (EASYSMFU)   119       10        1      0    0.1    212
BPXM023I (EASYSMFU)                                             
BPXM023I (EASYSMFU) Last 5 Minutes                              
BPXM023I (EASYSMFU)  Type  Subtype  Records     MB    Pct    Avg
BPXM023I (EASYSMFU)    14                 1      0    0.0    432
BPXM023I (EASYSMFU)    15                 1      0    0.0    432
BPXM023I (EASYSMFU)    30        2        2      0    0.7   3616
BPXM023I (EASYSMFU)    32        3        1      0    0.0    268
BPXM023I (EASYSMFU)    40                 1      0    0.0     74
BPXM023I (EASYSMFU)    42        6        4      0    1.5   3798
BPXM023I (EASYSMFU)    42       24        1      0    0.0    270
BPXM023I (EASYSMFU)    42       27        1      0    0.0    396
BPXM023I (EASYSMFU)    92       16       13      0    0.3    212
BPXM023I (EASYSMFU)    98        1       56      0   90.0  16055
BPXM023I (EASYSMFU)    98        3       56      0    6.2   1112
BPXM023I (EASYSMFU)   119        1        6      0    0.1    180
BPXM023I (EASYSMFU)   119        2        6      0    0.3    428
BPXM023I (EASYSMFU)   119       10        7      0    0.1    212
BPXM023I (EASYSMFU)   119       11       13      0    0.6    458
BPXM023I (EASYSMFU)                                             
BPXM023I (EASYSMFU) Last 60 Minutes                             
BPXM023I (EASYSMFU)  Type  Subtype  Records     MB    Pct    Avg
BPXM023I (EASYSMFU)     4                 3      0    0.0    215
BPXM023I (EASYSMFU)     5                 3      0    0.0    145
BPXM023I (EASYSMFU)    14                66      0    0.2    473
BPXM023I (EASYSMFU)    15                10      0    0.0    451
BPXM023I (EASYSMFU)    20                 1      0    0.0     95
BPXM023I (EASYSMFU)    23                 4      0    0.2   8350
...

Messages

The Real Time Agent also writes status messages to Splunk. See the EasySMF Status report.