All Apps and Add-ons

Splunk Add-on for IPFIX: Why we receiving ExecProcessor errors like "WARNING:root:Have not implemented parsing for 'None' of length 2"?

abhijit_mhatre
Path Finder

We are getting the following errors from the ExecProcessor component:

1) message from "python "C:\Program Files\Splunk\etc\apps\Splunk_TA_ipfix\bin\ipfix.py"" WARNING:root:Have not implemented parsing for 'None' of length 2 (5951:329) required for template 257.

2) message from "python "C:\Program Files\Splunk\etc\apps\Splunk_TA_ipfix\bin\ipfix.py"" WARNING:root:Have not implemented parsing for 'None' of length 2 (5951:330) required for template 289.

Could anyone tell us why these errors are coming & how to get rid of these errors?

0 Karma
1 Solution

mattymo
Splunk Employee
Splunk Employee

Hi!

the execprocessor is what runs scripted inputs in your environment.

The path is pointing to the app, Splunk_TA_ipfix, which contains ipfix.py in its bin.

C:\Program Files\Splunk\etc\apps\Splunk_TA_ipfix\bin\ipfix.py

Chucked it in the google machine and led me to this

Missing enterprise information element files
If you have not installed new enterprise element definition files for a data source received by the collector, you may see “Have not implemented parsing…” errors. This indicates that you are seeing new information elements that are not accounted for and need to update or add an information element file. Contact the device vendor for more information.

http://docs.splunk.com/Documentation/AddOns/released/IPFIX/Troubleshoot

Let me know if this leads you to a fix.

Thanks,

Matt

- MattyMo

View solution in original post

mattymo
Splunk Employee
Splunk Employee

Hi!

the execprocessor is what runs scripted inputs in your environment.

The path is pointing to the app, Splunk_TA_ipfix, which contains ipfix.py in its bin.

C:\Program Files\Splunk\etc\apps\Splunk_TA_ipfix\bin\ipfix.py

Chucked it in the google machine and led me to this

Missing enterprise information element files
If you have not installed new enterprise element definition files for a data source received by the collector, you may see “Have not implemented parsing…” errors. This indicates that you are seeing new information elements that are not accounted for and need to update or add an information element file. Contact the device vendor for more information.

http://docs.splunk.com/Documentation/AddOns/released/IPFIX/Troubleshoot

Let me know if this leads you to a fix.

Thanks,

Matt

- MattyMo
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...