Splunk Add-on for IPFIX: Why we receiving ExecProcessor errors like "WARNING:root:Have not implemented parsing for 'None' of length 2"?

[abhijit_mhatre]

We are getting the following errors from the ExecProcessor component:

1) message from "python "C:\Program Files\Splunk\etc\apps\Splunk_TA_ipfix\bin\ipfix.py"" WARNING:root:Have not implemented parsing for 'None' of length 2 (5951:329) required for template 257.

2) message from "python "C:\Program Files\Splunk\etc\apps\Splunk_TA_ipfix\bin\ipfix.py"" WARNING:root:Have not implemented parsing for 'None' of length 2 (5951:330) required for template 289.

Could anyone tell us why these errors are coming & how to get rid of these errors?

[mattymo · Accepted solution]

Hi!

the execprocessor is what runs scripted inputs in your environment.

The path is pointing to the app, Splunk_TA_ipfix, which contains ipfix.py in its bin.

C:\Program Files\Splunk\etc\apps\Splunk_TA_ipfix\bin\ipfix.py

Chucked it in the google machine and led me to this

Missing enterprise information element files
If you have not installed new enterprise element definition files for a data source received by the collector, you may see “Have not implemented parsing…” errors. This indicates that you are seeing new information elements that are not accounted for and need to update or add an information element file. Contact the device vendor for more information.

http://docs.splunk.com/Documentation/AddOns/released/IPFIX/Troubleshoot

Let me know if this leads you to a fix.

Thanks,

Matt