Does the ITM6 App for Splunk also work for ITCAM data?

[hgehrts_splunk]

Hi

Thanks for this App!

Question:
Since it is using the SOAP API into ITM, I assume it also works with ITCAM data?

BR
Hans-Henning Gehrts

[kierencrossland]

Hi,

Thats correct, if you can query the data using the CT_GET SOAP method, then you can use this app to grab the data to view in Splunk. Data from any ITM/ITCAM agent should be available as long as you can put together the CT_GET query. You can use the object style syntax, or sql.

If you have the dashboard data provider enabled on the TEPS you can browse this interface for data from the "Dashboard Data Browser" dashboard in the app. Its a bit more user friendly, but probably not as efficient as going to the TEMS directly using SOAP.

[kierencrossland]

Here's a sample query to get data from the ITCAM Agent for WebSphere Applications using the itmsoap search command.

The timefield parameter is used to tell Splunk to use that field to set the time of the search results.

| itmsoap tems=your_tems timefield=SDATE_TIME sql="SELECT SDATE_TIME,SERVER_NAM,STATUS,PID,STDATE_TIM,WAS_NNAM,WAS_CNAM FROM KYN.KYNAPSST AT ('your_rtems') WHERE SYSTEM.PARMA('NODELIST','Primary:your_target_host:KYNA', 25)"

I prefer to use the dashboard data interface though as it's a lot less hassle. the equivalent cmd:

|itmdash earliest=now latest=now tems=your_tems datasource=TMSAgent.%IBM.STATIC186 dataset=MetricGroup.KYNAPSST sourcetoken=Primary:your_target_host:KYNA

The advantages being that this command will use the timerange from the Splunk search if you remove earliest=now latest=now, and it doesn't need to be told which time field to use.