Splunk Support in TWAS

1. Overview

This RFE proposes native support for forwarding TWAS logs and operational data on zOS to Splunk.  The objective is to provide a standardized and supported mechanism for integrating WebSphere logs with enterprise Splunk monitoring and observability solutions.

2. Background: 

TWAS on zOS generates diagnostic and operational information across multiple locations, including application server logs, FFDC, trace files and z/OS job output available through SDSF.  Organizations increasingly use Splunk as a centralized Platform for application monitoring, troubleshooting, alerting and incident analysis.  A native or IBM supported integration would simplify the collection and forwarding of relevant WebSphere data to Splunk and reduce the need for custom solutions.

3. Objectives

a. Provide supported integration between TWAS on z/OS and Splunk

b. Enable centralized monitoring of WebSphere application and infrastructure logs

c. Support faster troubleshooting and correlation of WebSphere events with other enterprise systems.

d. Reduce dependency on custom scripts or other log forwarding mechanisms.

4. Scope:

The enhancement should consider WebSphere data from both USS based file and z/OS job SDSF output including System Out and Err, FFDC and trace files.  It should provide configurable options for selecting which logs/events are forwarded and should integrate without requiring significant changes to existing WebSphere configurations.

5. Requirements:

The solutions should provide secure, reliable forwarding to Splunk while also supporting filtering by server, cell, cluster and application levels. This should preserve timestamps and should be able to handle log rotation and server restarts without losing or duplicating events and minimize CPU and performance impact on LPARs running WebSphere Servers.

Conclusion:  Implementing native Splunk integration for TWAS on z/OS will provide centralized visibility into WebSphere logs and events and will enable faster problem identification and resolution.  An IBM supported integration will reduce any reliance on custom solutions and will improve monitoring, efficiency and system observability.