The DATA_FORMAT configuration parameter can be used to have Ironstream to use an alternate SMF record formatting routine in place of using the default routine. Initially, this change is for processing SMF 116 records (WebSphere MQ Accounting Data). The default formatting routine puts all MQ queue names in one created JSON event (the SMF field name is BASENAME and appears in Splunk as BASENAME_nnnn). Whereas, the alternate routine creates a separate JSON event for each queue named in the SMF record.
Generically, the DATA_FORMAT parameter comprises the SMF record type number and the alternate formatting routine, as follows:
"DATA_FORMAT":"<SMF_type>:<alternate_format_number>"For more information, see “Manually Setting Ironstream Parameters” in the Ironstream Configuration and User’s Guide.