SNMP Traps are being indexed in splunk, but errors in log. What do they mean?

[dcroteau]

Any help for the SNMP-TA modular input?

Even if snmp traps are being indexed now. I am still seeing the following errors on the logs. I think that some of them are errors in the MIBs such as the one for OID 1.3.6.1.4.1.xxxx.4.9.1.6.5.3.6 and some of them complain about snmp_stanza:snmp://X490_SNMP. I don’t know how to fix them.

I've x'd out the actual vendor part of the oid...I did not know if it constitutes "Personal Identifiable Info", so I did the safe thing.

02-13-2017 16:55:35.360 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Exception resolving MIB value in the caught trap: Can't coerce BindValue().setComponentByPosition(0, ObjectSyntax().setComponentByPosition(1, ApplicationSyntax().setComponentByPosition(2, TimeTicks(40601179)))) into integer: _BindValue instance has no attribute 'trunc' snmp_stanza:snmp://X490_SNMP
02-13-2017 16:55:35.360 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Exception resolving MIB value in the caught trap: Invalid sub-ID in (ObjectSyntax().setComponentByPosition(0, SimpleSyntax().setComponentByPosition(2, ObjectIdentifier(1.3.6.1.4.1.xxxx.4.9.1.6.5.3.6))), None, None, None, None) at ObjectIdentifier snmp_stanza:snmp://X490_SNMP
02-13-2017 16:55:35.360 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Exception resolving MIB value in the caught trap: Can't coerce _BindValue().setComponentByPosition(0, ObjectSyntax().setComponentByPosition(1, ApplicationSyntax().setComponentByPosition(5, Gauge32(126012)))) into integer: _BindValue instance has no attribute 'trunc_' snmp_stanza:snmp://X490_SNMP

[Damien_Dallimor · Accepted solution]

Assuming that you have attempted to convert the custom MIB's to python modules already and these are declared in inputs.conf....

I'm going to guess that you did not convert the MIB files to python modules correctly / completely.Perhaps there were MIB dependencies (usually listed at the top of the MIB file) inside those MIB files that you missed also ?

See my accepted answer here also :

https://answers.splunk.com/answers/216296/cannot-resolve-node-name-for-custom-mibs.html#answer-21681...