Collect Old QHST Messages with EVQHSTSEND - ironstream_for_elastic - ironstream_for_kafka - ironstream_for_splunk - 7.4

The EVQHSTSEND program may be used to re-collect an individual QHST message (or a range of messages) and re-send them through the Ironstream formatting process to deliver them to the EVSBS agent, filling in any gaps that are created if the EVQHSTPROC monitoring program is down.

Call syntax from the iSeries command line:

Program inputs:

DATTIM - starting timestamp, and optionally a hyphen and ending timestamp.

All 6 fields of a date/timestamp are required, but microseconds are optional. If specifying microseconds, enter all six digits. If microseconds are not specified on the ending timestamp, it will use ".999999" in the microseconds value. If no ending timestamp is given, EVQHSTSEND will attempt to collect all messages up to the *CURRENT time.

Similar to the regular EVSHSTPROC, EVQHSTSEND will read the message ID filter file and only send those messages with message IDs listed in the filter.

An output log (with any error messages) is written to the EVIEW/EVTRACE message queue with User Data "EVQHSTSEND" each time the program is run.

Note: If entering a specific date/time down to the microsecond for a specific message, subtract

.000001 from the message’s time before specifying it in the start parameter (see example 3 below).

Example calls:

CALL EVIEW/EVQHSTSEND PARM('DATTIM=2021.08.15.00.00.00')

CALL EVIEW/EVQHSTSEND

PARM('DATTIM=2021.08.15.00.00.00-2021.08.15.00.59.59')

CALL EVIEW/EVQHSTSEND PARM('DATTIM=2021.08.15.14.25.04.123455- 2021.08.15.14.25.04.123456')