topic Re: SNMP doesnt get any data in Splunk Dev

SNMP doesnt get any data

jadengoho — Tue, 08 May 2018 09:07:55 GMT

I do all the configuration needed but still no data ingesting in the splunk

##POLL###
[snmp://<NAME>]
communitystring = public
destination = <ip address of the server>
do_bulk_get = 0
do_get_subtree = 0
index = <index_name>
ipv6 = 0
mib_names = <SMI>,<Custom MIB's i put in .egg>
object_names = <OID's>
port = 161
snmp_mode = attributes
snmp_version = 2C
sourcetype = <sourcetype_name>
split_bulk_output = 0
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol

I deploy the addon on the universal forwarder, and reload the DS ,
But still no data ingesting .

Re: SNMP doesnt get any data

koshyk — Tue, 08 May 2018 10:55:21 GMT

which conf file you are updating this? Do you have an SNMP app for this?

Re: SNMP doesnt get any data

jadengoho — Tue, 08 May 2018 23:16:50 GMT

yes there is a SNMP app deployed to 20 Universal Forwarders.
I am updating the snmp_ta/local/inputs.conf

Re: SNMP doesnt get any data

jadengoho — Tue, 08 May 2018 23:29:50 GMT

is it connected to this message :

INFO ExecProcessor - Removing status item "/opt/splunk/etc/apps/snmp_ta/bin/snmp.py (snmp://testing) (isModInput=yes)

Re: SNMP doesnt get any data

jkat54 — Wed, 09 May 2018 01:29:12 GMT

The app requires python. Therefore it must be installed on full splunk installs (heavy forwarders,
Etc).

Thanks!

Re: SNMP doesnt get any data

jadengoho — Wed, 09 May 2018 03:41:52 GMT

i try to install i tto the Heavy forwarder with python 2.7 but still no data incomming

Re: SNMP doesnt get any data

jadengoho — Wed, 09 May 2018 07:13:46 GMT

i am getting this log
index=_internal ExecProcessor error snmp.py host="HF1

5/9/18
3:11:58.976 AM  
05-09-2018 03:11:58.976 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Traceback (most recent call last):
host =  prd-usc1-a-splunk-hf1 source =  /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/9/18
3:11:58.976 AM  
05-09-2018 03:11:58.976 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py"   File "/opt/splunk/etc/apps/snmp_ta/bin/snmp.py", line 771, in <module>
host =  prd-usc1-a-splunk-hf1 source =  /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/9/18
3:11:58.976 AM  
05-09-2018 03:11:58.976 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py"     do_run()
host =  prd-usc1-a-splunk-hf1 source =  /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/9/18
3:11:58.976 AM  
05-09-2018 03:11:58.976 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py"   File "/opt/splunk/etc/apps/snmp_ta/bin/snmp.py", line 475, in do_run
host =  prd-usc1-a-splunk-hf1 source =  /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/9/18
3:11:58.976 AM  
05-09-2018 03:11:58.976 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py"     mibBuilder.loadModules(*mib_names_args)
host =  prd-usc1-a-splunk-hf1 source =  /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/9/18
3:11:58.976 AM  
05-09-2018 03:11:58.976 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py"   File "/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 270, in loadModules
host =  prd-usc1-a-splunk-hf1 source =  /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
5/9/18
3:11:58.976 AM  
05-09-2018 03:11:58.976 -0400 ERROR ExecProcessor - message from "python /opt/spl

Re: SNMP doesnt get any data

jkat54 — Wed, 09 May 2018 11:24:29 GMT

Can you share the results of this search?

index=_internal snmp.py host="HF1