OA60106: CDP TO HANDLE COMMA IN RMF III FIELD SO SPLUNK DOES NOT SEE IT AS A DELIMITER.

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• RMF III data that is collected by CDP is displayed incorrectly
  in Splunk via HEC when there is comma in the value.
  

Local fix

• n/a
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of IBM Common Data Provider for z  *
  *                 Systems v2.1.                                *
  ****************************************************************
  * PROBLEM DESCRIPTION: RMF III data that is collected by CDP   *
  *                      is displayed incorrectly in Splunk via  *
  *                      HEC when there is comma in the value.   *
  ****************************************************************
  * RECOMMENDATION: Apply this PTF.                              *
  ****************************************************************
  The comma is considered as delimiter by Splunk, when the data is
  formatted as K-V pair for HEC, the surrounded double quotes have
  been ignored incorrectly.
  

Problem conclusion

• CDP v2.1 is updated to fix this problem above.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UJ04234

Modules/Macros

• HBOCDEDS HBOCDEUI HBOCFGA  HBOCFGT  HBOCHGP  HBODS001 HBODSPRO
  HBORDAPI HBORS001 HBOSSCR
  

Fix information

• Fixed component name

  CDP BASE

• Fixed component ID

  5698ABJ00

Applicable component levels

• R210 PSY UJ04234

     UP20/11/05 P F011

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.