All Apps and Add-ons

Not able to view SNMP POLL data in splunk?

prakashsbk
Explorer

Hi All

We are using snmp_ta(snmp-modular-input_184) version 1.8.4 to get SNMP POLL data , we have configured MIBs as per the documents but we are able to see the data in splunk. 

Configuration: we have configured for BRIDGE-MIB and IF-MIB  below as the details of BRIDGE-MIB

[snmp://BRIDGE]
activation_key = XXXXXXXXXXXXXXXXX
communitystring = public
destination = xxx.xx.xx.xx
do_bulk_get = 1
do_get_subtree = 0
index = catch_all
ipv6 = 0
mib_names = BRIDGE-MIB
object_names =
port = 161
response_handler = SplitNonBulkResponseHandler
snmp_mode = attributes
snmp_version = 2C
sourcetype = snmp_poll
split_bulk_output = 1
timeout = 5
trap_rdns = 0
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol

Checks: 

a) snmpwalk - command is working

b) no errors noticed in snmpmodinput_app_modularinput.log and splunkd.log 

c) snmp services are running 

ps -ef | grep snmp
splunk 2955262 2954920 0 13:57 ? 00:00:00 /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/snmp_ta/bin/snmp.py
splunk 2955268 2954920 0 13:57 ? 00:00:00 /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/snmp_ta/bin/snmp.py

Kindly please help me why SNMP poll data is not reaching splunk and any steps that we have missed ?

Also let us know if there any steps to validate SNMP POLL data

 

 

 

 

2023-05-29 10:38:37,270 INFO Starting process checker thread for parent PID 2926939  stanza:snmp://BRIDGE
2023-05-29 10:38:37,271 INFO Using Splunk's python stanza:snmp://BRIDGE
2023-05-29 10:38:37,271 INFO SNMP Modular Input executing stanza:snmp://BRIDGE
2023-05-29 10:38:37,281 INFO Building MIBs stanza:snmp://BRIDGE
2023-05-29 10:40:01,723 INFO Starting process checker thread for parent PID 2928030  stanza:snmp://BRIDGE
2023-05-29 10:40:01,762 INFO Using Splunk's python stanza:snmp://BRIDGE
2023-05-29 10:40:01,762 INFO SNMP Modular Input executing stanza:snmp://BRIDGE
2023-05-29 10:40:01,855 INFO Building MIBs stanza:snmp://BRIDGE
2023-05-29 10:48:11,878 INFO Starting process checker thread for parent PID 2929393  stanza:snmp://BRIDGE
2023-05-29 10:48:11,889 INFO Using Splunk's python stanza:snmp://BRIDGE
2023-05-29 10:48:11,889 INFO SNMP Modular Input executing stanza:snmp://BRIDGE
2023-05-29 10:48:11,927 INFO Building MIBs stanza:snmp://BRIDGE
2023-05-29 11:34:24,088 INFO Starting process checker thread for parent PID 2935597  stanza:snmp://BRIDGE
2023-05-29 11:34:24,191 INFO Using Splunk's python stanza:snmp://BRIDGE
2023-05-29 11:34:24,191 INFO SNMP Modular Input executing stanza:snmp://BRIDGE
2023-05-29 11:34:24,247 INFO Building MIBs stanza:snmp://BRIDGE
2023-05-29 11:47:58,495 INFO Starting process checker thread for parent PID 2937457  stanza:snmp://BRIDGE
2023-05-29 11:47:58,509 INFO Using Splunk's python stanza:snmp://BRIDGE
2023-05-29 11:47:58,509 INFO SNMP Modular Input executing stanza:snmp://BRIDGE
2023-05-29 11:47:58,575 INFO Building MIBs stanza:snmp://BRIDGE
2023-05-29 13:30:24,627 INFO Starting process checker thread for parent PID 2949972  stanza:snmp://BRIDGE
2023-05-29 13:30:24,672 INFO Using Splunk's python stanza:snmp://BRIDGE
2023-05-29 13:30:24,672 INFO SNMP Modular Input executing stanza:snmp://BRIDGE
2023-05-29 13:30:24,748 INFO Building MIBs stanza:snmp://BRIDGE
2023-05-29 13:55:34,635 INFO Starting process checker thread for parent PID 2954014  stanza:snmp://BRIDGE
2023-05-29 13:55:34,669 INFO Using Splunk's python stanza:snmp://BRIDGE
2023-05-29 13:55:34,669 INFO SNMP Modular Input executing stanza:snmp://BRIDGE
2023-05-29 13:55:34,742 INFO Building MIBs stanza:snmp://BRIDGE
2023-05-29 13:57:12,038 INFO Starting process checker thread for parent PID 2954920  stanza:snmp://BRIDGE
2023-05-29 13:57:12,038 INFO Using Splunk's python stanza:snmp://BRIDGE
2023-05-29 13:57:12,038 INFO SNMP Modular Input executing stanza:snmp://BRIDGE
2023-05-29 13:57:12,075 INFO Building MIBs stanza:snmp://BRIDGE

************  IF-MIB ****************
2023-05-29 13:55:34,744 INFO Building MIBs stanza:snmp://IPMIB
2023-05-29 13:57:12,768 INFO Starting process checker thread for parent PID 2954920  stanza:snmp://IPMIB
2023-05-29 13:57:12,842 INFO Using Splunk's python stanza:snmp://IPMIB
2023-05-29 13:57:12,842 DEBUG running pysnmp version 4.4.12 stanza:snmp://IPMIB
2023-05-29 13:57:12,842 DEBUG debug category 'io' enabled stanza:snmp://IPMIB
2023-05-29 13:57:12,842 DEBUG debug category 'dsp' enabled stanza:snmp://IPMIB
2023-05-29 13:57:12,842 DEBUG debug category 'msgproc' enabled stanza:snmp://IPMIB
2023-05-29 13:57:12,842 DEBUG debug category 'secmod' enabled stanza:snmp://IPMIB
2023-05-29 13:57:12,842 DEBUG debug category 'proxy' enabled stanza:snmp://IPMIB
2023-05-29 13:57:12,842 INFO SNMP Modular Input executing stanza:snmp://IPMIB
2023-05-29 13:57:12,880 INFO Building MIBs stanza:snmp://IPMIB
*************** splunkd.log  output of cat splunkd.log | grep snmp  ****
05-29-2023 13:55:36.217 +0100 INFO  WatchedFile [2954371 tailreader0] - Will begin reading at offset=6186 for file='/opt/splunk/var/log/splunk/1537685e8d29b1deb1f7562f984e6806_snmpmodinput_app_modularinput.log'.
05-29-2023 13:55:36.218 +0100 INFO  WatchedFile [2954371 tailreader0] - Will begin reading at offset=2400 for file='/opt/splunk/var/log/splunk/651a0f0fde8ef37438adcef45b20bea2_snmpmodinput_app_modularinput.log'.
05-29-2023 13:57:00.101 +0100 INFO  SpecFiles [2954916 MainThread] - Found external scheme definition for stanza="snmp://" from spec file="/opt/splunk/etc/apps/snmp_ta/README/inputs.conf.spec" with parameters="activation_key, snmp_mode, destination, ipv6, port, snmp_version, object_names, do_get_subtree, do_bulk_get, split_bulk_output, non_repeaters, max_repetitions, lexicographic_mode, communitystring, v3_securityName, v3_securityEngineId, v3_authKey, v3_privKey, v3_authProtocol, v3_privProtocol, snmpinterval, timeout, retries, listen_traps, trap_port, trap_host, trap_rdns, mib_names, response_handler, response_handler_args, log_level, use_system_python, system_python_path, run_process_checker"
05-29-2023 13:57:02.435 +0100 INFO  ModularInputs [2954916 MainThread] - Endpoint argument settings for "snmp_mode":
05-29-2023 13:57:02.435 +0100 INFO  ModularInputs [2954916 MainThread] - Endpoint argument settings for "snmp_version":
05-29-2023 13:57:02.435 +0100 INFO  ModularInputs [2954916 MainThread] - Endpoint argument settings for "snmpinterval":
05-29-2023 13:57:02.435 +0100 INFO  ModularInputs [2954916 MainThread] - Introspection setup completed for scheme "snmp".
05-29-2023 13:57:11.754 +0100 INFO  ExecProcessor [2955230 exec_1] - New scheduled exec process: /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/snmp_ta/bin/snmp.py
05-29-2023 13:57:11.754 +0100 INFO  ExecProcessor [2955230 exec_1] - New scheduled exec process: /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/snmp_ta/bin/snmp.py
05-29-2023 13:57:13.832 +0100 INFO  WatchedFile [2955265 tailreader1] - Will begin reading at offset=6507 for file='/opt/splunk/var/log/splunk/1537685e8d29b1deb1f7562f984e6806_snmpmodinput_app_modularinput.log'.
05-29-2023 13:57:13.833 +0100 INFO  WatchedFile [2955265 tailreader1] - Will begin reading at offset=3200 for file='/opt/splunk/var/log/splunk/651a0f0fde8ef37438adcef45b20bea2_snmpmodinput_app_modularinput.log'.

 

 

 

 

 

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...