Configure Logging to a Splunk Server

Use the Server Manager to configure event logging for selected CSM services to a Splunk Server. Event logging records significant events and errors, and is used for troubleshooting.

Splunk is a third-party tool that identifies data patterns, provides metrics, diagnoses problems, and provides intelligence for business operations. CSM integrates with Splunk so that CSM event log data can be indexed and made easily searchable. Download and install Splunk onto a server and configure it for logging events.

To configure logging to a Splunk server:

1. Select Start > All Programs > Cherwell Service Management > Tools > Server Manager.
2. Select a service from the Server drop-down list.
   Note: If you select the Cherwell Service Host, logging is enabled for all microservices. To configure logging for specific microservices, select Cherwell Service Host, then click the Logging button and select the microservice from the Services list.
3. Click the Logging button.

   The Logging Options window for the selected Server opens.

4. Select the Log to Splunk check box.
5. Select a log level:
   • Debug and above: Very verbose messages. This level is space and resource intensive.
     Note: For best results, log debug messages (Debug and above) to a file or to Splunk, and NOT to an event log. CSM logs numerous debug messages, so a log would be slow and might require more resources.
   • Stats and above: Detailed messages that track performance.
   • Info and above: Informational messages that can be used to diagnose a problem.
   • Warning and above: Warning messages that occurred.
   • Error and above: Errors that were encountered.
   • Fatal only: Errors that caused the service or process to stop.
6. Click OK.
7. In the Log Server area, click the Configure button.
8. Define the following settings:
   • Server URL: Provide the URL of the Splunk Server (example: https://splunkserver:8089).
   • User Name: Provide the user name for the Splunk Server acount.
   • Password: Provide the password of the individual with an account on the Splunk Server.
   • Ignore Certificate Errors: Select this check box to ignore certificate errors that might be generated by Splunk using self-signed certificates to encrypt data. Select this check box only if you trust your connection with the server.
9. Select Test to test the connection to the Splunk Server.

10. Select OK.