Configuring the IBM Z Agent - ironstream_for_splunk - ironstream_for_kafka - Ironstream_Hub - ironstream_for_elastic - 1.3

Ironstream Hub Administration

Product type
Software
Portfolio
Integrate
Product family
Ironstream
Product
Ironstream > Ironstream Hub
Ironstream > Ironstream for Kafka®
Ironstream > Ironstream for Elastic®
Ironstream > Ironstream for Splunk®
Version
1.3
Language
English
ContentType
Administration
Product name
Ironstream Hub
Title
Ironstream Hub Administration
First publish date
2022
ft:lastEdition
2024-04-15
ft:lastPublication
2024-04-15T10:44:03.897025

When using Ironstream for IBM Z as a Source, the agent should be configured with the parameter "TARGET":"GENERIC" because JSON records will be delimited with “\n” and metadata such as might be included for Splunk is not present. This means the format is compatible with Hub.

Example Ironstream core configuration file:
[KEYS]
"KEY_WARN_DAYS":"090"
"KEY":"xxxxxx"
[SYSTEM]
"NAME":"IHS4"
[DESTINATION]
"TARGET":"GENERIC"
"IPADDRESS":"10.16.0.112"
"PORT":"4236"
"SSL":"NO"
[SOURCE]
"DATATYPE":"SYSLOG"
"FILTER":"SSDFFLOG"

The important items are that TARGET should be set to GENERIC, the IPADRESS should point to the Hub system, and the PORT value should match the port set for an IBM Z source.

Note: All Hub delimiter properties, including TcpIpServerConfiguration:Delimiter, should be set to “\n”.