I have the SNMP Modular Input app installed on a RHEL 7 server that's acting as a Splunk universal forwarder (it's currently working as a "syslog server" that receives syslog events from appliances and sends them to Splunk). I've configured the app directly via the inputs.conf, but I am noting the following error in splunkd.log:
01-07-2019 08:01:40.999 -0600 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/snmp_ta/bin/snmp.py" No SNMP response received before timeout snmp_stanza:snmp://snmp_poll
My troubleshooting steps so far:
- A snmpwalk execution from the Splunk server ("server A") to the server that I'm polling for SNMP data ("server B") returns a "Timeout: No Response" error.
- I am able to reach UDP port 161 on server B from server A successfully using "nc -vu".
- I've validated that UDP port 161 is open on server A using "firewall-cmd --list-all".
I'm trying to wrap my ahead around what else I may need to look into at this point. The error seems to imply that the problem is on the server B side, but I don't want to assume that. Are there any additional ports I need to look into (for example: is port 161 the only port I need to have open on server A)? Or, something else entirely that I'm overlooking?
Thank you!
