All Apps and Add-ons
Highlighted

SNMP Traps are being indexed in splunk, but errors in log. What do they mean?

Splunk Employee
Splunk Employee

Any help for the SNMP-TA modular input?

Even if snmp traps are being indexed now. I am still seeing the following errors on the logs. I think that some of them are errors in the MIBs such as the one for OID 1.3.6.1.4.1.xxxx.4.9.1.6.5.3.6 and some of them complain about snmpstanza:snmp://X490SNMP. I don’t know how to fix them.

I've x'd out the actual vendor part of the oid...I did not know if it constitutes "Personal Identifiable Info", so I did the safe thing.

02-13-2017 16:55:35.360 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmpta/bin/snmp.py" Exception resolving MIB value in the caught trap: Can't coerce _BindValue().setComponentByPosition(0, ObjectSyntax().setComponentByPosition(1, ApplicationSyntax().setComponentByPosition(2, TimeTicks(40601179)))) into integer: _BindValue instance has no attribute 'trunc' snmpstanza:snmp://X490SNMP
02-13-2017 16:55:35.360 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp
ta/bin/snmp.py" Exception resolving MIB value in the caught trap: Invalid sub-ID in (ObjectSyntax().setComponentByPosition(0, SimpleSyntax().setComponentByPosition(2, ObjectIdentifier(1.3.6.1.4.1.xxxx.4.9.1.6.5.3.6))), None, None, None, None) at ObjectIdentifier snmpstanza:snmp://X490SNMP
02-13-2017 16:55:35.360 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmpta/bin/snmp.py" Exception resolving MIB value in the caught trap: Can't coerce _BindValue().setComponentByPosition(0, ObjectSyntax().setComponentByPosition(1, ApplicationSyntax().setComponentByPosition(5, Gauge32(126012)))) into integer: _BindValue instance has no attribute 'trunc' snmpstanza:snmp://X490_SNMP

0 Karma
Highlighted

Re: SNMP Traps are being indexed in splunk, but errors in log. What do they mean?

Ultra Champion

Assuming that you have attempted to convert the custom MIB's to python modules already and these are declared in inputs.conf....

I'm going to guess that you did not convert the MIB files to python modules correctly / completely.Perhaps there were MIB dependencies (usually listed at the top of the MIB file) inside those MIB files that you missed also ?

See my accepted answer here also :

https://answers.splunk.com/answers/216296/cannot-resolve-node-name-for-custom-mibs.html#answer-21681...

View solution in original post

0 Karma