While setting up the ODBC Probe, we ran into a few snags.  The goal of this project is to integrate Solarwinds Orion and Netcool.  We ran into issues with data extraction from the DB and field compatibility.  Hopefully these lessons learned with help someone out there.

This is the second part of the Splunk integration piece.  Information on configuring Splunk to send SNMP can be found here Sending SNMP Traps from Splunk.  

To receive traps from Netcool we need to set the rules.  The following code can be put into the mttrapd rules file, or better practice says put it in a separate file named something like splunk.rules and then include it in the mttrapd.rules.
 

We started with the idea to generate alerts from Splunk that would forward to IBM Tivoli Netcool. This can be used with any SNMP aggregator, and can be customized to send any data that is needed. This article can be used in conjunction with Splunk Rules for Netcool to integrate Splunk with Netcool. This assumes you are running Splunk on *nix.

I needed a dashboard that would display a stop light view of the enterprise. Designed the map, but then how do I make the map elements clickable to change the Active Event List (AEL) filter in the next portlet? Wires? Maps do not have wires. This is how I did it.

1. Create a file called aelpage.html in

/systemApps/isclite.ear/Webtop.war/

2. Paste the following into the file:

Begin Code

I wanted to create a map that had at least 200 conditional icons, and then another 50 labels and such. This was taking forever using the map builder, and I thought back to my filter creation experience. If I could create the filters by editing a file, why couldn’t I edit the map the same way?

I wanted to add\edit a filter collection in Netcool that was going to be at least 200 filters.  Obviously, this would take forever to do through the WebGUI.  There has to be a faster\easier way.  I searched the database, nothing there.  Pressing on to find the config file that contains the information, I added a filter and then searched for that string in the configs.  

I found ..\IBM\Tivoli\tip\TIPProfile\etc\webtop\data\global\filter.xml

I am trying to work in Netcool WebGUI and it randomly logs me out with a session invalid error.

Error message: "Your session has become invalid. This is due to a session timeout or an administrator has logged you out"

I then log back in and get the same error twice before it finally lets me back in.

This was found to be while doing anything java related. This included TBSM, Filter Builder, Maps, Active Event List (AEL) and other java related pages.

By default, SPLUNK allows SSL v2 for backwards compatibility. For security purposes, it is good practice to disable SSLv2. Other security requirements or standards may also require it be disabled. Among these are PCI and DISA STIG Compliance.

Assuming you have already enabled SSL on SPLUNK, you would edit the $SPLUNK_HOME/etc/system/local/web.conf and add the following line in the SSL settings portion.

supportSSLV3Only = True

Yesterday we were given a task of changing the SSL levels for the web interface in SPLUNK. After doing so, we restarted SPLUNK. After attempting to log back in, we were greeted with the following crash report.

2012-02-15 18:05:14.916 +0000 splunkd started (build 115073) terminate called after throwing an instance of 'PropertyPagesException' what(): Cannot get user to act as: No user info provider registered (user: XXXXXXX, app: user-prefs, root:/opt/splunk/etc)

I wanted to be able to update a field in SMARTS that would show point of contact information for a given device.  Here’s how I did it.

First, create a matrix of information.  This can be as simple as two columns, device names and contacts.

Device 1, Team1 (555) 555-5555

Device 2, Team1 (555) 555-5556

Device 3, Team1 (555) 555-5557

Then create a script to access this information and use the following command to update SMARTS.