topic Re: Splunk Add-on for OPC UA: Why do I receive an error when gathering "metrics" in the input screen? in All Apps and Add-ons

Splunk Add-on for OPC UA: Why do I receive an error when gathering "metrics" in the input screen?

ggeihs03 — Tue, 29 Sep 2020 11:23:16 GMT

Hello. I can browse my local OPC UA server (Siemens simatic net OPC) using a third party opc browser. However I am unable to connect using the Splunk "Add OPC UA Input" screen. When attempting to browse, I get error "In handler 'ta_opcua_address_address': Unable to xml-parse the following data: %sSplunk_TA_opcua".

In one of the pre-release versions, I had to enter the "read nodes" manually, but I don't see this option anymore.

Re: Splunk Add-on for OPC UA: Why do I receive an error when gathering "metrics" in the input screen?

ggeihs03 — Fri, 14 Oct 2016 18:41:15 GMT

From my log:...

time="2016-10-14T14:22:47-04:00" level=debug msg="endpoint: 0 [pass] - &opcua.EndpointDescription{EndpointURL:\"opc.tcp://mycomputerip:myport\", Server:opcua.ApplicationDescription{ApplicationURI:\"urn:Siemens.Automation.SimaticNET.S7:{9892DE7D-47C6-4543-A596-234B588F7090}\", ProductURI:\"Siemens/SimaticNet/OpcUaServer/S7\", ApplicationName:opcua.LocalizedText{Locale:\"en\", Text:\"OPC.SimaticNET.S7\"}, ApplicationType:0x0, GatewayServerURI:\"\", DiscoveryProfileURI:\"\", DiscoveryURLs:[]opcua.String{\"opc.tcp://mycomputerip:myport\"}}, ServerCertificate:opcua.ByteString{xxxxredactedxxxxx}, SecurityMode:0x3, SecurityPolicyURI:\"http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15\", UserIdentityTokens:[]opcua.UserTokenPolicy{opcua.UserTokenPolicy{PolicyID:\"Anonymous\", TokenType:0x0, IssuedTokenType:\"\", IssuerEndpointURL:\"\", SecurityPolicyURI:\"\"}, opcua.UserTokenPolicy{PolicyID:\"UserName\", TokenType:0x1, IssuedTokenType:\"\", IssuerEndpointURL:\"\", SecurityPolicyURI:\"http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15\"}}, TransportProfileURI:\"http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary\", SecurityLevel:0x82}" 
time="2016-10-14T14:22:47-04:00" level=debug msg="endpoint: 1 [select] - &opcua.EndpointDescription{EndpointURL:\"opc.tcp://mycomputerip:myport\", Server:opcua.ApplicationDescription{ApplicationURI:\"urn:Siemens.Automation.SimaticNET.S7:{9892DE7D-47C6-4543-A596-234B588F7090}\", ProductURI:\"Siemens/SimaticNet/OpcUaServer/S7\", ApplicationName:opcua.LocalizedText{Locale:\"en\", Text:\"OPC.SimaticNET.S7\"}, ApplicationType:0x0, GatewayServerURI:\"\", DiscoveryProfileURI:\"\", DiscoveryURLs:[]opcua.String{\"opc.tcp://mycomputerip:myport\"}}, ServerCertificate:opcua.ByteString{xxxxredacted}, SecurityMode:0x1, SecurityPolicyURI:\"http://opcfoundation.org/UA/SecurityPolicy#None\", UserIdentityTokens:[]opcua.UserTokenPolicy{opcua.UserTokenPolicy{PolicyID:\"Anonymous\", TokenType:0x0, IssuedTokenType:\"\", IssuerEndpointURL:\"\", SecurityPolicyURI:\"\"}, opcua.UserTokenPolicy{PolicyID:\"UserName\", TokenType:0x1, IssuedTokenType:\"\", IssuerEndpointURL:\"\", SecurityPolicyURI:\"http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15\"}}, TransportProfileURI:\"http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary\", SecurityLevel:0x0}" 
time="2016-10-14T14:22:47-04:00" level=debug msg="userIdentityToken: 0 [select] - opcua.UserTokenPolicy{PolicyID:\"Anonymous\", TokenType:0x0, IssuedTokenType:\"\", IssuerEndpointURL:\"\", SecurityPolicyURI:\"\"}"

Re: Splunk Add-on for OPC UA: Why do I receive an error when gathering "metrics" in the input screen?

lli_splunk — Mon, 24 Oct 2016 08:48:31 GMT

Hi @ggeihs03, in new version you don't have to enter read nodes manually, you should go to OpcUA configuration page from Splunk launcher first and then add new OpcUA server in configuration page (you should specify a concrete OpcUA endpoint, e.g. opc.tcp://localhost:53530/OPCUA/SimulationServer), after adding new OpcUA server then go to inputs page and add a new input select read nodes from metric tree.

config OpcUA server
config input

Re: Splunk Add-on for OPC UA: Why do I receive an error when gathering "metrics" in the input screen?

ggeihs03 — Tue, 29 Sep 2020 11:35:20 GMT

Hello,

I have configured a server, however I get the XML error "Unable to xml-parse the following data: %sSplunk_TA_opcua"

I can see the server and point to tags using opc.tcp://192.168.1.3:4845 in several standalone opcua browsers. However when trying to pick the metrics in splunk I get the error.

Re: Splunk Add-on for OPC UA: Why do I receive an error when gathering "metrics" in the input screen?

lli_splunk — Tue, 29 Sep 2020 11:32:44 GMT

Hi,

I cleaned up old version and reinstalled again but couldn't recreate the problem. Can you give more detailed log, especially from $SPLUNK_HOME/var/log/splunk/ta_opcua_*.log, it could be helpful for me to find the problem.

Re: Splunk Add-on for OPC UA: Why do I receive an error when gathering "metrics" in the input screen?

wguan_splunk — Mon, 14 Nov 2016 05:07:08 GMT

Hi @ggeihs03, thank you for this report!

It will be very help for if you can share the error messages of ajax calls:

Browser's Dev tool is very useful for this case, Chrome for example:

Open Dev tool, and go to the network tab.

Open the "Create New Input" and select the server:

If there is any, click the item will show the whole description 🙂

Thanks!

Re: Splunk Add-on for OPC UA: Why do I receive an error when gathering "metrics" in the input screen?

CleberLupianhez — Tue, 29 Sep 2020 21:18:36 GMT

Hello! I do not know if the question has evolved, but ....

I solved it by changing the configuration of the file opcua_address_space_chunk_manager.py, highlighted below.
I realize that this problem is due to the number of TAGs on the OPC server, in this configuration I can read an OPC server with almost 2,000 TAGs.

/ opt / splunk / etc / apps / Splunk_TA_opcua / bin.

OpcUaAddressSpaceChunkManager class (object):
OPCUA_ADDRESS_SPACE_CHECKPOINT_DIR = 'ta_opcua_address_space'

10 minutes

OPCUA_ADDRESS_SPACE_EXPIRE_TIME = 600

8 MB

OPCUA_ADDRESS_SPACE_CHUNK_SIZE = 8*1024*1024