http://blog.pengoworks.com/index.cfm/2007/11/1/Configuring-Windows-Authentication-with-Apache-22x-and-Subversion

\etc\apps\search\local\inputs.conf

[monitor:\\\\SANCIFS_TDC_NETAPP01A.SAN.MyCompany.Com\CIFS_COGNOS$\Test\Logs]
disabled = false
host = sancifs_test
index = default
sourcetype = motio_test

The main thing to be cognizant of is who is running Splunkd; especially on Windows. On this particular windows machine, I had it setup to run as "Local System Account",
and that is probably not what you want.

I had to reconfigure the Windows Service to be run as: COMPANY_DOMAIN\admin_user

We were able to find a pattern for the PID, SessionID, and RequestID in the logs, but they do not fall into a key-value pair pattern. They are separated by what appear to be spaces in the logs. Splunk’s IFX allowed us to easily go through the data and select which "columns" were for the PID, SessionID, and RequestID. So now when we search through the data, we are automatically given data counts for all of the aforementioned fields.

Their tutorial was extremely easy to follow as well:

http://www.splunk.com/base/Documentation/latest/User/Fieldsextractiontutorial

$SPLUNK_HOME/bin/splunk search ‘|savedsearch “Splunk errors last 24 hours”‘

The primary reason I am looking to run Saved Searches from the Command Line Interface (CLI) is to have a scheduled query kick off a script after an error occurs that will sleep for a few minutes and then run a search similar to the one above to test for a server restart.

So when my WebSphere App Server throws a java.lang.OutOfMemoryError, I want to wait a few minutes and make sure that the server restarted. There may be a better design then what I have put together but so far this is the only way I can think to solve the problem. However, I am still searching for a better solution.

UPDATE

Something else to be aware of is the permissions of the Saved Search.  If you created the Saved Search as yourself (bobsmith), but you try to run it as an admin account from the CLI, then the admin account will not have access unless you give permissions to the admin (or everyone) to run it.

Well, no longer do you have to wait for the Summary page.

1 – Navigate to: Manager -> User interface -> Navigation menus -> default

2 – move the location of the default from the “dashboard” to the “flashtimeline”

...
<view name="dashboard" />
<view name="flashtimeline" default='true'  />
...

3 – Revel in knowing that you no longer see the Dashboard, and now see the Search page by default

<errorDetail><errorCode>-13</errorCode><errorMessage>CAM-CRP-0157 Unable to complete a call to the cryptographic provider’s unwrap function.</errorMessage><errorStack><errorCode>-13</errorCode><errorMessage>CAM-CRP-0285 Unable to find an appropriate Common Symmetric Key (CSK) to decrypt the data.</errorMessage></errorStack></errorDetail>

We solved this problem by following the steps in this link:

http://www-01.ibm.com/support/docview.wss?uid=swg21340774

Keep in mind that some of the items you are deleting are files, and some are directories.

We have no flippin’ idea how this problem occurred, and we will probably not look too hard into it unless it happens again.
These types of rogue errors with no good explanation occur too frequently in Cognos.

Portal probably has its place in solving some business problem (although I have not seen one yet), but I’d really like to meet the salesperson who sold my company on the fact that IBM Portal would solve their issues.

What we are trying to accomplish could so easily be done with simple Servlets and static HTML pages with a CMS system front-end. Hell, you don’t even need Spring MVC or Struts.

Scenario: You go to export a page from the Portal Console, and you receive a 403 Forbidden page, instead of the exported file. I then went through the logs and discovered the error:

[10/7/09 14:04:53:935 CDT] 00000062 WebCollaborat A SECJ0129E: Authorization failed for scconlo while invoking GET on default_host:/wps/PA_1_NO2UF4I1186E1026H4BLVI00L6/exportServlet, Authorization failed, Not granted any of the required roles: exportPortalPagesRole
[10/7/09 14:05:27:796 CDT] 00000062 WebCollaborat A SECJ0129E: Authorization failed for scconlo while invoking GET on default_host:/wps/PA_1_NO2UF4I1186E1026H4BLVI00L6/exportServlet, Authorization failed, Not granted any of the required roles: exportPortalPagesRole

However, I do a Google Search for “websphere portal 403 exportPortalPagesRole” (http://lmgtfy.com/?q=websphere+portal+403+exportPortalPagesRole), and there is 1 result returned: http://dev.binarysoul.net/2009/08/11/2-bugs-in-websphere-portal-6-0-1-6-fix-pack/

This is a great post by “Jonathan”, which details the problem and the solution.

Check it out if you have the aforementioned issue.

Luckily this update worked like a charm. That is the first time something worked as expected with Portal, and will probably be the last.

I do not in any way admit to knowing exactly what is going on below here. It took a long time to
search the web and find this piece of information, and I hope someone else finds it here faster then
it took me to find it.

public Map retrieveStringsFromPageParameters(PortletRequest req, PortletResponse resp, List pageParamsToRetrieve){
Map toRet = null;
try{
Context ctx = new InitialContext();

PortletServiceHome psh = (PortletServiceHome) ctx.lookup(“portletservice/” + NavigationSelectionModelProvider.class.getName());

if (psh != null) {
ContentMetaDataModelProvider cmdmProvider = (ContentMetaDataModelProvider) psh.getPortletService(ContentMetaDataModelProvider .class);
ContentMetaDataModel cmdm = cmdmProvider.getContentMetaDataModel(req, resp);
NavigationSelectionModelProvider provider = (NavigationSelectionModelProvider) psh.getPortletService(NavigationSelectionModelProvider.class);
NavigationSelectionModel model = provider.getNavigationSelectionModel(req, resp);
NavigationNode selectedNode = (NavigationNode) model.getSelectedNode();

if (selectedNode != null) {
MetaData md = cmdm.getMetaData(selectedNode);

if(md != null){
toRet = new HashMap();
for(Iterator itr = pageParamsToRetrieve.iterator(); itr.hasNext(); ){
String pageParamToGet = (String) itr.next();
String pageParamValue = (String)md.getValue(pageParamToGet);

toRet.put(pageParamToGet, pageParamValue);
}
}
}
}
}catch (Exception e){
logger.debug(e);
}
return toRet;
}