Ironstream

Hello,

I am still fairly new to Ironstream for Splunk.  We are looking to change how we have Splunk set up on our different systems and I'm trying to figure out if we actually need the SSDFHFS file mounted, and if so, in what mode.

The documentation says Ironstream needs the SSDFHFS file when using IDT, DCE, and Log4j appender.

I have no idea of what those things are or when they would be used.

I currently have Ironstream for Splunk installed with the SDFAPI, SDFLOG, SDFSMF, and SDFSYS forwarder tasks running.

Do any of those tasks make use of IDT, DCE, or the Log4j appender?  I'm thinking not, but I really don't know that much about Ironstream.  I basically just installed it and set up the started tasks for someone else that was more familiar with Ironstream.

If IDE, DCE, or the Log4j appender are not being used, can I get by without mounting the SSDFHFS file system?

Thank you,

Hello Alan,

Thank you for reaching out.

As far as I am aware, yes, you can run Ironstream without mounting SSDFHFS.  However, you will most likely run into issues if you later decide to make use of the IDT (RMF III), USS (Unix files) or Log4j support.  If you want further technical detail please raise a ticket with our Support Team.

I have noted your question and will look to get a Knowledge Base Article created or documentation update applied to cover this topic for future reference.

Hello,

I am still fairly new to Ironstream for Splunk.  We are looking to change how we have Splunk set up on our different systems and I'm trying to figure out if we actually need the SSDFHFS file mounted, and if so, in what mode.

The documentation says Ironstream needs the SSDFHFS file when using IDT, DCE, and Log4j appender.

I have no idea of what those things are or when they would be used.

I currently have Ironstream for Splunk installed with the SDFAPI, SDFLOG, SDFSMF, and SDFSYS forwarder tasks running.

Do any of those tasks make use of IDT, DCE, or the Log4j appender?  I'm thinking not, but I really don't know that much about Ironstream.  I basically just installed it and set up the started tasks for someone else that was more familiar with Ironstream.

If IDE, DCE, or the Log4j appender are not being used, can I get by without mounting the SSDFHFS file system?

Thank you,

Hello Alan,

Thank you for reaching out.

As far as I am aware, yes, you can run Ironstream without mounting SSDFHFS.  However, you will most likely run into issues if you later decide to make use of the IDT (RMF III), USS (Unix files) or Log4j support.  If you want further technical detail please raise a ticket with our Support Team.

I have noted your question and will look to get a Knowledge Base Article created or documentation update applied to cover this topic for future reference.

Hello,

I am still fairly new to Ironstream for Splunk.  We are looking to change how we have Splunk set up on our different systems and I'm trying to figure out if we actually need the SSDFHFS file mounted, and if so, in what mode.

The documentation says Ironstream needs the SSDFHFS file when using IDT, DCE, and Log4j appender.

I have no idea of what those things are or when they would be used.

I currently have Ironstream for Splunk installed with the SDFAPI, SDFLOG, SDFSMF, and SDFSYS forwarder tasks running.

Do any of those tasks make use of IDT, DCE, or the Log4j appender?  I'm thinking not, but I really don't know that much about Ironstream.  I basically just installed it and set up the started tasks for someone else that was more familiar with Ironstream.

If IDE, DCE, or the Log4j appender are not being used, can I get by without mounting the SSDFHFS file system?

Thank you,