This warning has been polluting my internal logs for a long time:
11-27-2019 13:39:46.280 +0000 WARN IndexedCSV - csv file /opt/splunk/var/run/searchpeers/B5C95237-71AF-4203-AD5C-F88B10308CFC-1574861980/apps/cisco_ios/lookups/cisco_ios_messages.csv has 2 missing fields
Today I finally decided to look at it. Using some filtering in Excel, I found two lines in the cisco_ios_messages.csv lookup file in this app that didn't have all the columns populated:
splunk@splunk:[~/etc/shcluster/apps/cisco_ios/lookups]> grep '""' cisco_ios_messages.csv
"ZONE","6","ZS_INVALID_MEMBER","Invalid member [dec] [chars]","Invalid member type [dec] [chars] recieved from the API call.",""
"ZONE","6","ZS_UNKNOWN_LIC_FEATURE","[chars]","",""
A bit of googling uncovered this Cisco page Cisco MDS 9000 Family and Nexus 7000 Series NX-OS System Messages Reference. With the information from that page, I fixed the lookup file. Now the internal errors are gone:
"ZONE","6","ZS_INVALID_MEMBER","Invalid member [dec] [chars]","Invalid member type [dec] [chars] recieved from the API call.","No action is required."
"ZONE","6","ZS_UNKNOWN_LIC_FEATURE","[chars]","Zone Server received an event for an known licensing feature: [chars].","No action is required."
Thank you for the app!
