Data Model for Mainframe in Splunk: The Newest Feature of Ironstream
1 like467 views
The document describes the Ironstream® Splunk data model for mainframes, which provides a structured way to categorize and search datasets effectively, making data more accessible and consumable. It emphasizes the benefits of the model such as faster searching, user-friendly structures, and integration of domain knowledge for enhanced reporting and analytics. The document also highlights the model's adaptability to customer requirements and its applicability to various metrics and systems.
Data Model for Mainframe in Splunk: The Newest Feature of Ironstream
- 1. Ironstream® Splunk >® Data Model for Mainframe Ian Hartley, Principal Engineer Splunk > is a registered trademark of Splunk Inc. in the USA and other countries
- 2. Housekeeping Webcast Audio • Today’s webcast audio is streamed through your computer speakers. • If you need technical assistance with the web interface or audio, please reach out to us using the chat window. Questions Welcome • Submit your questions at any time during the presentation using the chat window. • We will answer them during our Q&A session following the presentation. Recording and slides • This webcast is being recorded. You will receive an email following the webcast with a link to download both the recording and the slides.
- 6. Typical Scenario Splunk > is a registered trademark of Splunk Inc. in the USA and other countries
- 7. Typical Scenario Splunk > is a registered trademark of Splunk Inc. in the USA and other countries { }..?..
- 8. Typical Scenario Splunk > is a registered trademark of Splunk Inc. in the USA and other countries Data Model Mainframe Batch CICS® Db2®
- 9. What? A Splunk data model is: “Hierarchically structured search-time mapping of semantic knowledge about one or more datasets. It encodes the domain knowledge necessary to build a variety of specialized searches of those datasets.” Source: Splunk documentation • Splunk structure to categorize data into logical groups (datasets) • Populated from one or more data sources • Parent > Child hierarchy • Dataset fields (inherited via structure) • Can incorporate • Searches • Transactions (e.g. batch job from start to end) • ‘Bakes-in’ SME knowledge • An “intelligent lens” over your indexed data • Data becomes: • Structured, logical, more consumable • More accessible by non-SMEs • Normalized diverse data: IPaddress ≡ ClientIP • Friendly field names: SMF030JBN as Job Name • Create complex reports via point and click …no need to write searches • Models can be “accelerated” …faster searching • Splunk use data models • Common Information Model (CIM) • Enterprise Security, IT Service Intelligence, etc. • Used at search-time – no indexing overhead • No license impact • Makes working with data easier • Broaden access to mainframe metrics • Faster ROI Why? *Summary Indexing (if needed) *
- 10. • Data model … 42 datasets … 550+ fields • Batch (Jobs, Started tasks) • CICS® • Db2® (Buffer Pool Activity, CPU, Locking, SQL Calls, System Storage Use) • Resources (RMF III, System State, Workload Activity) • Security (ACF2™, RACF®, Top Secret®) • Syslog • TSO • + ‘Intelligence’ (calculations: CPU time, CICS transaction response, etc.) • Splunk Event types (to categorize data) • Splunk Macros (to locate data) • Summary Index searches (make ‘complex’ Db2 and RMF III data available to model) • Sample dashboard (example use of datamodel & pivot commands) • README.PDF (overview, installation & config instructions, mainframe data sources) What’s in the Box? CICS, Db2, RACF are registered trademarks of IBM Inc. in the USA and other countries. ACF2 and Top Secret are registered trademarks of Broadcom Inc. in the USA and other countries.
- 27. Model ++ • Driven by customer requirements • Examining possibilities for extending the model • More metrics and intelligence • Standard calculations (usage, response times, averages, etc.) • Other platforms • IBM i (iSeries) • Metrics from other Syncsort products • Customer-specific needs (e.g. only production LPARs) • Something missing? Want something adding? • Contact your Syncsort representative
- 28. Benefits… ✓ Opens metrics to a broader audience ✓ Presents user-friendly, categorized structure ✓ Includes ‘intelligence’ for faster ROI ✓ Enables faster searching (via optional acceleration) No need to… ✓ Know specific data sources ✓ Decipher cryptic field names ✓ Research and recreate essential calculations ✓ Be a mainframe SME Summary: Data Model for Mainframe
- 29. Q & A https://www.syncsort.com/en/products/mainframe/ironstream https://mysupport.syncsort.com/products/ironstream Data Model for Mainframe… Ironstream® Free trial…