All Apps and Add-ons

Splunk Add-on for IPFIX: Why we receiving ExecProcessor errors like "WARNING:root:Have not implemented parsing for 'None' of length 2"?

abhijit_mhatre
Path Finder

We are getting the following errors from the ExecProcessor component:

1) message from "python "C:\Program Files\Splunk\etc\apps\Splunk_TA_ipfix\bin\ipfix.py"" WARNING:root:Have not implemented parsing for 'None' of length 2 (5951:329) required for template 257.

2) message from "python "C:\Program Files\Splunk\etc\apps\Splunk_TA_ipfix\bin\ipfix.py"" WARNING:root:Have not implemented parsing for 'None' of length 2 (5951:330) required for template 289.

Could anyone tell us why these errors are coming & how to get rid of these errors?

0 Karma
1 Solution

mattymo
Splunk Employee
Splunk Employee

Hi!

the execprocessor is what runs scripted inputs in your environment.

The path is pointing to the app, Splunk_TA_ipfix, which contains ipfix.py in its bin.

C:\Program Files\Splunk\etc\apps\Splunk_TA_ipfix\bin\ipfix.py

Chucked it in the google machine and led me to this

Missing enterprise information element files
If you have not installed new enterprise element definition files for a data source received by the collector, you may see “Have not implemented parsing…” errors. This indicates that you are seeing new information elements that are not accounted for and need to update or add an information element file. Contact the device vendor for more information.

http://docs.splunk.com/Documentation/AddOns/released/IPFIX/Troubleshoot

Let me know if this leads you to a fix.

Thanks,

Matt

- MattyMo

View solution in original post

mattymo
Splunk Employee
Splunk Employee

Hi!

the execprocessor is what runs scripted inputs in your environment.

The path is pointing to the app, Splunk_TA_ipfix, which contains ipfix.py in its bin.

C:\Program Files\Splunk\etc\apps\Splunk_TA_ipfix\bin\ipfix.py

Chucked it in the google machine and led me to this

Missing enterprise information element files
If you have not installed new enterprise element definition files for a data source received by the collector, you may see “Have not implemented parsing…” errors. This indicates that you are seeing new information elements that are not accounted for and need to update or add an information element file. Contact the device vendor for more information.

http://docs.splunk.com/Documentation/AddOns/released/IPFIX/Troubleshoot

Let me know if this leads you to a fix.

Thanks,

Matt

- MattyMo
Get Updates on the Splunk Community!

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...