You will need to configure this in the product that is sending the SMF records to Splunk, presumably Syncsort (whatever they call themselves now) Ironstream.
Charles -----Original Message----- From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf Of MARTIN, MIKE Sent: Monday, May 9, 2022 8:57 AM To: [email protected] Subject: Producing throwaway SMF? Well, not exactly throwaway, but is there a way to produce SMF/RMF record types (say CICS 110-2's) for sending to a product like Splunk, but not write them to our SMF datasets (non-streams). (I realize products like Splunk probably have a way to intercept/send the data) but we may not want to save the data to our SMF datasets with the 110-2 records if we turn them on. Mike Martin This email may contain confidential and privileged material for the sole use of the intended recipient. If you are not the intended recipient, please contact the sender and delete all copies. Any review or distribution by others is strictly prohibited. Personal emails are restricted by policy of the State Employees' Credit Union (SECU). Therefore SECU specifically disclaims any responsibility or liability for any personal information or opinions of the author expressed in this email. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
