All Apps and Add-ons

Loss of connection after few hours to ITM CQ server

splunkreal
Motivator

Hello,

we lose connection trying to collect data with the DASH input. We are using Splunk 6.5.2

Also when trying to use the input, we get 500 error in web_service.log (see attached)link text

Restarting the itm cq server resolves the problem, any idea?

Thanks.

* If this helps, please upvote or accept solution 🙂 *
0 Karma
1 Solution

kierencrossland
Path Finder

Hi,

I have been looking into an issue where the TEPS begins to run out of memory after many dash requests. I think we have managed to fix this, but I havent had chance to update the app in splunkbase.

If you want to apply this manually then download itm.zip and place the files in the following dirs:

$splunkhome/etc/apps/ITM6/bin/itmdash.py
$splunkhome/etc/apps/ITM6/bin/itm6/dash.py

I'd be interested to see if that clears up your issue.

When the splunk app stops working, are you able to manually get data back from the dashboard data provider using curl? For example listing systems:

curl -G -u '$user:$password' --data-urlencode properties=all -k http://$host:15200/ibm/tivoli/rest/providers/itm.$temsname/datasources/TMSAgent.%26IBM.STATIC000/dat...

View solution in original post

kierencrossland
Path Finder

Hi,

I have been looking into an issue where the TEPS begins to run out of memory after many dash requests. I think we have managed to fix this, but I havent had chance to update the app in splunkbase.

If you want to apply this manually then download itm.zip and place the files in the following dirs:

$splunkhome/etc/apps/ITM6/bin/itmdash.py
$splunkhome/etc/apps/ITM6/bin/itm6/dash.py

I'd be interested to see if that clears up your issue.

When the splunk app stops working, are you able to manually get data back from the dashboard data provider using curl? For example listing systems:

curl -G -u '$user:$password' --data-urlencode properties=all -k http://$host:15200/ibm/tivoli/rest/providers/itm.$temsname/datasources/TMSAgent.%26IBM.STATIC000/dat...

splunkreal
Motivator

Hi Kieren,

there is a problem adding those files :

Unable to initialize modular input "itm6_dash_input" defined inside the app "ITM6": Introspecting scheme=itm6_dash_input: script running failed (exited with code 1).
from itm6.dash import dash as itm6_dash
return self.request(endpoint='datasources/%s/datasets/mgrp/items' % datasource, payload={'properties':'MGROUP', 'param_Refresh':0}})
File "/OPT/siem/splunk/etc/apps/ITM6/bin/itm6/dash.py", line 83
File "/OPT/siem/splunk/etc/apps/ITM6/bin/itmdash.py", line 6, in
External search command 'itmdash' returned error code 1.
SyntaxError: invalid syntax

Thanks for your help.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

kierencrossland
Path Finder

Apologies for that. There appears to be a stray } on lines 83 and 89 on the copy of that code on my git.

Are you able to change 83 to:
return self.request(endpoint='datasources/%s/datasets/mgrp/items' % datasource, payload={'properties':'MGROUP', 'param_Refresh':0})

and 89 to:
return self.request(endpoint='datasources/%s/datasets/msys/items' % datasource,payload={'properties':'ORIGINNODE', 'param_Refresh':0})

0 Karma

splunkreal
Motivator

Hi Kieren,

the memory/vcpu upgrade yesterday solved already the problem. I applied your patch anyway 🙂 Thanks a lot.

Maybe you could give some recommendations regarding memory to use correctly your app.

That's great job anyway!

* If this helps, please upvote or accept solution 🙂 *
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...