All Apps and Add-ons

Loss of connection after few hours to ITM CQ server

realsplunk
Motivator

Hello,

we lose connection trying to collect data with the DASH input. We are using Splunk 6.5.2

Also when trying to use the input, we get 500 error in web_service.log (see attached)link text

Restarting the itm cq server resolves the problem, any idea?

Thanks.

0 Karma
1 Solution

kierencrossland
Path Finder

Hi,

I have been looking into an issue where the TEPS begins to run out of memory after many dash requests. I think we have managed to fix this, but I havent had chance to update the app in splunkbase.

If you want to apply this manually then download itm.zip and place the files in the following dirs:

$splunkhome/etc/apps/ITM6/bin/itmdash.py
$splunkhome/etc/apps/ITM6/bin/itm6/dash.py

I'd be interested to see if that clears up your issue.

When the splunk app stops working, are you able to manually get data back from the dashboard data provider using curl? For example listing systems:

curl -G -u '$user:$password' --data-urlencode properties=all -k http://$host:15200/ibm/tivoli/rest/providers/itm.$temsname/datasources/TMSAgent.%26IBM.STATIC000/dat...

View solution in original post

kierencrossland
Path Finder

Hi,

I have been looking into an issue where the TEPS begins to run out of memory after many dash requests. I think we have managed to fix this, but I havent had chance to update the app in splunkbase.

If you want to apply this manually then download itm.zip and place the files in the following dirs:

$splunkhome/etc/apps/ITM6/bin/itmdash.py
$splunkhome/etc/apps/ITM6/bin/itm6/dash.py

I'd be interested to see if that clears up your issue.

When the splunk app stops working, are you able to manually get data back from the dashboard data provider using curl? For example listing systems:

curl -G -u '$user:$password' --data-urlencode properties=all -k http://$host:15200/ibm/tivoli/rest/providers/itm.$temsname/datasources/TMSAgent.%26IBM.STATIC000/dat...

realsplunk
Motivator

Hi Kieren,

there is a problem adding those files :

Unable to initialize modular input "itm6_dash_input" defined inside the app "ITM6": Introspecting scheme=itm6_dash_input: script running failed (exited with code 1).
from itm6.dash import dash as itm6_dash
return self.request(endpoint='datasources/%s/datasets/mgrp/items' % datasource, payload={'properties':'MGROUP', 'param_Refresh':0}})
File "/OPT/siem/splunk/etc/apps/ITM6/bin/itm6/dash.py", line 83
File "/OPT/siem/splunk/etc/apps/ITM6/bin/itmdash.py", line 6, in
External search command 'itmdash' returned error code 1.
SyntaxError: invalid syntax

Thanks for your help.

0 Karma

kierencrossland
Path Finder

Apologies for that. There appears to be a stray } on lines 83 and 89 on the copy of that code on my git.

Are you able to change 83 to:
return self.request(endpoint='datasources/%s/datasets/mgrp/items' % datasource, payload={'properties':'MGROUP', 'param_Refresh':0})

and 89 to:
return self.request(endpoint='datasources/%s/datasets/msys/items' % datasource,payload={'properties':'ORIGINNODE', 'param_Refresh':0})

0 Karma

realsplunk
Motivator

Hi Kieren,

the memory/vcpu upgrade yesterday solved already the problem. I applied your patch anyway 🙂 Thanks a lot.

Maybe you could give some recommendations regarding memory to use correctly your app.

That's great job anyway!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...