Apologies for that. There appears to be a stray } on lines 83 and 89 on the copy of that code on my git. Are you able to change 83 to: return self.request(endpoint='datasources/%s/datasets/mgrp/items' % datasource, payload={'properties':'MGROUP', 'param_Refresh':0}) and 89 to: return self.request(endpoint='datasources/%s/datasets/msys/items' % datasource,payload={'properties':'ORIGINNODE', 'param_Refresh':0}) ... View more

Pleased to hear you got this sorted. I was on holiday when you posted the question and was unable to reply. Can you describe what was incorrect in ITM6/local/tems.conf, I'd like to stop this from happening again in a future release ... View more

I saw a comment about you being on version 6.2.3 in my emails, but cant find it on here... Anyway I think your right, the dashboard data provider is introduced in 6.3. I have updated the prereqs of the app on splunkbase to mention this. I the meantime though you can still use the app to make your own dashboards using the SOAP interface. There's a few good examples of SOAP queries here. Heres a couple of example SOAP queries we use to pull back data from Linux OS agents: # Disk used percent | itmsoap tems=$tems$ fields="TIMESTAMP,ORIGINNODE,MOUNTPT,DSKUSEDPCT" table="KLZ.KLZDISK" nodelist=$msl$ at="All Remotes" clause="MOUNTPT LIKE '*DB2*'" timefield=TIMESTAMP # Aggregate CPU usage | itmsoap tems=$tems$ fields="TIMESTAMP,ORIGINNODE,SYSCPU,CPUID" table="KLZ.KLZCPU" nodelist=$msl$ at="All Remotes" clause="CPUID = -1" timefield=TIMESTAMP | eval SYSCPU=SYSCPU/100 | rename SYSCPU AS "System CPU (Percent)" ... View more

If your on *nix then swap kincinfo.exe for cinfo. I guessed at Windows because your Splunk env is on it. TEMS port is 1920, and TEPS is 15200. Jazz use's the dashboard data provider to get ITM data, but you don't need Jazz to run it. To enable the dashboard data provider reconfigure your TEPS, and answer yes to the following question: itmcmd config -A cq .... Enable ITM REST service ? (1=Yes, 2=No)(Default is: 2): 1 .... Then recycle the TEPS. Make sure the server is listening by running netstat on your TEPS server: netstat -an | grep 15200 ... View more

It looks like your getting an unsuccessful http response from the dashboard data provider. What happens if you try to access "http://xxx:15200/ibm/tivoli/rest/providers/itm.xxx/datasources" in a browser? The first xxx is the TEMS hostname, and second one is the TEMS instance name, seen when running "kincinfo.exe -r" on the TEMS server. Pretty sure the later xxx is case sensitive as well. If the original url from the error you pasted above does not work, then adjust it in your browser until its correct or try http://xxx:15200/ibm/tivoli/rest/providers, this should give you a link to the itm.xxx part. Then amend the TEMS details in Splunk to match the working hostname and instance combination. ... View more

The datasource dropdown uses this search to populate itself: | itmdash tems=$tems$ Try running that from the Splunk search, replacing your $tems$ with your tems instance name. It may produce a useful error message. Also try the same for a basic SOAP query in a Splunk search: | itmsoap tems=$tems$ sql="SELECT NODE,VERSION,THRUNODE,O4ONLINE,PRODUCT FROM O4SRV.INODESTS" Do either of these work? and if not do they produce an error message that might let us know what is happening? I'd also make sure that the Splunk server can access ports 1920 and 15200 on the TEMS server just to check there isn't a firewall getting in the way of things. ... View more

Also, once you have the TEMS connection working use the magnifying glass on any of the packaged dashboards to see the Splunk search used to get ITM data, there are dashboards that use both DASH and SOAP. ... View more

At the moment there is just the guide in the documentation tab on Splunkbase. Hopefully the info below can get you started. You first need to make sure ITM is running the SOAP and Dashboard Data Provider interfaces. Currently these need to be available over http, and not https. You probably have these running already... Then in the ITM6 app for Splunk you need to add some details of the ITM environment by navigating to ITM6 app for Splunk > Settings > Manage TEMS Connections > New. Once you have done this, navigate to ITM6 app for Splunk > Dashboards > Dashboard Data Browser. This dashboard populates drop down menu's allowing you to browse the Dashboard Data Provider endpoints without needing to type any Splunk searches. Although handily you can then click the small magnifying glass in the bottom left of the generated table to see the Splunk search used to grab the data from ITM. ... View more

Here's a sample query to get data from the ITCAM Agent for WebSphere Applications using the itmsoap search command. The timefield parameter is used to tell Splunk to use that field to set the time of the search results. | itmsoap tems=your_tems timefield=SDATE_TIME sql="SELECT SDATE_TIME,SERVER_NAM,STATUS,PID,STDATE_TIM,WAS_NNAM,WAS_CNAM FROM KYN.KYNAPSST AT ('your_rtems') WHERE SYSTEM.PARMA('NODELIST','Primary:your_target_host:KYNA', 25)" I prefer to use the dashboard data interface though as it's a lot less hassle. the equivalent cmd: |itmdash earliest=now latest=now tems=your_tems datasource=TMSAgent.%IBM.STATIC186 dataset=MetricGroup.KYNAPSST sourcetoken=Primary:your_target_host:KYNA The advantages being that this command will use the timerange from the Splunk search if you remove earliest=now latest=now , and it doesn't need to be told which time field to use. ... View more

Hi, Thats correct, if you can query the data using the CT_GET SOAP method, then you can use this app to grab the data to view in Splunk. Data from any ITM/ITCAM agent should be available as long as you can put together the CT_GET query. You can use the object style syntax, or sql. If you have the dashboard data provider enabled on the TEPS you can browse this interface for data from the "Dashboard Data Browser" dashboard in the app. Its a bit more user friendly, but probably not as efficient as going to the TEMS directly using SOAP. ... View more

Thanks piUek, I didnt realise I could extend simple xml like that. Usually in this situation I would convert the dashboard to html/js, or use web frameworrk, but in doing this you lose some simplicity in maintaining the dashboard. I like the idea of keeping the dashboard in simple xml where possible, so using a javascript extension seems like the perfect solution. ... View more

Another thought on this. To just amend the permissions of the files that exist in the upgrade tar to make sure no other file permissions get changed you can just do this: tar -tvf splunkforwarder-6.1.1-207789-AIX-powerpc.tar | awk '{print $9}' | xargs chmod 700 tar -xf splunkforwarder-6.1.1-207789-AIX-powerpc.tar Now any files that will not be replaced by the tar maintain their existing permissions. ... View more

I stumbled across this post while having the same issue trying to upgrade a splunk 6.0 forwarder to 6.1.1 on AIX. There are several files in the forwarder that have read only or read and execute permissions only, tar is unable to overwrite these files. tar -xf splunkforwarder-6.1.1-207789-AIX-powerpc.tar .... tar: can't create splunkforwarder/etc/system/README/wmi.conf.spec: Permission denied ls -l splunkforwarder/etc/system/README/wmi.conf.spec -r-------- 1 user group 6213 May 9 08:29 splunkforwarder/etc/system/README/wmi.conf.spec My solution was to just chmod the existing files so that tar can overwrite them, but also use the -p option so that the file mode is preserved from the tar archive. chmod -R 700 splunkforwarder ls -l splunkforwarder/etc/system/README/wmi.conf.spec -rwx------ 1 user group 6213 May 9 08:29 splunkforwarder/etc/system/README/wmi.conf.spec tar -xpf splunkforwarder-6.1.1-207789-AIX-powerpc.tar ls -l splunkforwarder/etc/system/README/wmi.conf.spec -r--r--r-- 1 user group 6213 May 9 08:29 splunkforwarder/etc/system/README/wmi.conf.spec The result is that any files overwritten by the tar command have the permissions that they were archived with ... View more