Clickable map links to open Active Event List filters in another portlet.

I needed a dashboard that would display a stop light view of the enterprise. Designed the map, but then how do I make the map elements clickable to change the Active Event List (AEL) filter in the next portlet? Wires? Maps do not have wires. This is how I did it.

1. Create a file called aelpage.html in


2. Paste the following into the file:

Begin Code

Bulk Filter Creation on Netcool WebGUI

I wanted to add\edit a filter collection in Netcool that was going to be at least 200 filters.  Obviously, this would take forever to do through the WebGUI.  There has to be a faster\easier way.  I searched the database, nothing there.  Pressing on to find the config file that contains the information, I added a filter and then searched for that string in the configs.  

I found ..\IBM\Tivoli\tip\TIPProfile\etc\webtop\data\global\filter.xml

Random Invalid Session Errors in Netcool WebGUI

I am trying to work in Netcool WebGUI and it randomly logs me out with a session invalid error.

Error message: "Your session has become invalid. This is due to a session timeout or an administrator has logged you out"

I then log back in and get the same error twice before it finally lets me back in.

This was found to be while doing anything java related. This included TBSM, Filter Builder, Maps, Active Event List (AEL) and other java related pages.

Block SSLv2 in SPLUNK

By default, SPLUNK allows SSL v2 for backwards compatibility. For security purposes, it is good practice to disable SSLv2. Other security requirements or standards may also require it be disabled. Among these are PCI and DISA STIG Compliance.

Assuming you have already enabled SSL on SPLUNK, you would edit the $SPLUNK_HOME/etc/system/local/web.conf and add the following line in the SSL settings portion.

supportSSLV3Only = True

How to fix 'PropertyPagesException' what(): Cannot get user to act as: No user info provider registered

Yesterday we were given a task of changing the SSL levels for the web interface in SPLUNK. After doing so, we restarted SPLUNK. After attempting to log back in, we were greeted with the following crash report.

2012-02-15 18:05:14.916 +0000 splunkd started (build 115073) terminate called after throwing an instance of 'PropertyPagesException' what(): Cannot get user to act as: No user info provider registered (user: XXXXXXX, app: user-prefs, root:/opt/splunk/etc)

Update user defined fields easy event enrichment in SMARTS

I wanted to be able to update a field in SMARTS that would show point of contact information for a given device.  Here’s how I did it.

First, create a matrix of information.  This can be as simple as two columns, device names and contacts.

Device 1, Team1 (555) 555-5555

Device 2, Team1 (555) 555-5556

Device 3, Team1 (555) 555-5557

Then create a script to access this information and use the following command to update SMARTS.