All Apps and Add-ons

Loss of connection after few hours to ITM CQ server

splunkreal
Motivator

Hello,

we lose connection trying to collect data with the DASH input. We are using Splunk 6.5.2

Also when trying to use the input, we get 500 error in web_service.log (see attached)link text

Restarting the itm cq server resolves the problem, any idea?

Thanks.

* If this helps, please upvote or accept solution 🙂 *
0 Karma
1 Solution

kierencrossland
Path Finder

Hi,

I have been looking into an issue where the TEPS begins to run out of memory after many dash requests. I think we have managed to fix this, but I havent had chance to update the app in splunkbase.

If you want to apply this manually then download itm.zip and place the files in the following dirs:

$splunkhome/etc/apps/ITM6/bin/itmdash.py
$splunkhome/etc/apps/ITM6/bin/itm6/dash.py

I'd be interested to see if that clears up your issue.

When the splunk app stops working, are you able to manually get data back from the dashboard data provider using curl? For example listing systems:

curl -G -u '$user:$password' --data-urlencode properties=all -k http://$host:15200/ibm/tivoli/rest/providers/itm.$temsname/datasources/TMSAgent.%26IBM.STATIC000/dat...

View solution in original post

kierencrossland
Path Finder

Hi,

I have been looking into an issue where the TEPS begins to run out of memory after many dash requests. I think we have managed to fix this, but I havent had chance to update the app in splunkbase.

If you want to apply this manually then download itm.zip and place the files in the following dirs:

$splunkhome/etc/apps/ITM6/bin/itmdash.py
$splunkhome/etc/apps/ITM6/bin/itm6/dash.py

I'd be interested to see if that clears up your issue.

When the splunk app stops working, are you able to manually get data back from the dashboard data provider using curl? For example listing systems:

curl -G -u '$user:$password' --data-urlencode properties=all -k http://$host:15200/ibm/tivoli/rest/providers/itm.$temsname/datasources/TMSAgent.%26IBM.STATIC000/dat...

splunkreal
Motivator

Hi Kieren,

there is a problem adding those files :

Unable to initialize modular input "itm6_dash_input" defined inside the app "ITM6": Introspecting scheme=itm6_dash_input: script running failed (exited with code 1).
from itm6.dash import dash as itm6_dash
return self.request(endpoint='datasources/%s/datasets/mgrp/items' % datasource, payload={'properties':'MGROUP', 'param_Refresh':0}})
File "/OPT/siem/splunk/etc/apps/ITM6/bin/itm6/dash.py", line 83
File "/OPT/siem/splunk/etc/apps/ITM6/bin/itmdash.py", line 6, in
External search command 'itmdash' returned error code 1.
SyntaxError: invalid syntax

Thanks for your help.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

kierencrossland
Path Finder

Apologies for that. There appears to be a stray } on lines 83 and 89 on the copy of that code on my git.

Are you able to change 83 to:
return self.request(endpoint='datasources/%s/datasets/mgrp/items' % datasource, payload={'properties':'MGROUP', 'param_Refresh':0})

and 89 to:
return self.request(endpoint='datasources/%s/datasets/msys/items' % datasource,payload={'properties':'ORIGINNODE', 'param_Refresh':0})

0 Karma

splunkreal
Motivator

Hi Kieren,

the memory/vcpu upgrade yesterday solved already the problem. I applied your patch anyway 🙂 Thanks a lot.

Maybe you could give some recommendations regarding memory to use correctly your app.

That's great job anyway!

* If this helps, please upvote or accept solution 🙂 *
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...