When using Ironstream for IBM Z as a data source, it can be configured with four different target options TARGET – “GENERIC”, “KAFKA”, “SPLUNK”, or “ELASTIC”.
When using Ironstream for IBM Z as a data source for Hub, “GENERIC” is the best option for the TARGET parameter because records will be delimited with “\n” and the Splunk metadata is not included, which means the format is compatible with Hub.
Example Ironstream configuration file:
"KEYS"
"KEY_WARN_DAYS":"090"
"KEY":"xxxxxx"
"SYSTEM"
"NAME":"IHS4"
"DESTINATION"
"TARGET":"GENERIC"
"IPADDRESS":"10.16.0.112"
"PORT":"4236"
"SSL":"NO"
"SOURCE"
"DATATYPE":"SYSLOG"
"FILTER":"SSDFFLOG"
Note: All Hub delimiter properties, including TcpIpServerConfiguration:Delimiter, should be set to “\n”.