All Apps and Add-ons

Splunk Add-on for OPC UA: Why do I receive an error when gathering "metrics" in the input screen?

ggeihs03
New Member

Hello. I can browse my local OPC UA server (Siemens simatic net OPC) using a third party opc browser. However I am unable to connect using the Splunk "Add OPC UA Input" screen. When attempting to browse, I get error "In handler 'ta_opcua_address_address': Unable to xml-parse the following data: %sSplunk_TA_opcua".

In one of the pre-release versions, I had to enter the "read nodes" manually, but I don't see this option anymore.

0 Karma

CleberLupianhez
New Member

Hello! I do not know if the question has evolved, but ....

I solved it by changing the configuration of the file opcua_address_space_chunk_manager.py, highlighted below.
I realize that this problem is due to the number of TAGs on the OPC server, in this configuration I can read an OPC server with almost 2,000 TAGs.

/ opt / splunk / etc / apps / Splunk_TA_opcua / bin.

OpcUaAddressSpaceChunkManager class (object):
OPCUA_ADDRESS_SPACE_CHECKPOINT_DIR = 'ta_opcua_address_space'

10 minutes

OPCUA_ADDRESS_SPACE_EXPIRE_TIME = 600

8 MB

OPCUA_ADDRESS_SPACE_CHUNK_SIZE = 8*1024*1024

0 Karma

wguan_splunk
Splunk Employee
Splunk Employee

Hi @ggeihs03, thank you for this report!

It will be very help for if you can share the error messages of ajax calls:

Browser's Dev tool is very useful for this case, Chrome for example:

Open Dev tool, and go to the network tab.
alt text
Open the "Create New Input" and select the server:
alt text
If there is any, click the item will show the whole description 🙂

Thanks!

0 Karma

lli_splunk
Splunk Employee
Splunk Employee

Hi @ggeihs03, in new version you don't have to enter read nodes manually, you should go to OpcUA configuration page from Splunk launcher first and then add new OpcUA server in configuration page (you should specify a concrete OpcUA endpoint, e.g. opc.tcp://localhost:53530/OPCUA/SimulationServer), after adding new OpcUA server then go to inputs page and add a new input select read nodes from metric tree.

  1. config OpcUA server
    alt text

  2. config input
    alt text

0 Karma

ggeihs03
New Member

Hello,

I have configured a server, however I get the XML error "Unable to xml-parse the following data: %sSplunk_TA_opcua"

I can see the server and point to tags using opc.tcp://192.168.1.3:4845 in several standalone opcua browsers. However when trying to pick the metrics in splunk I get the error.

0 Karma

lli_splunk
Splunk Employee
Splunk Employee

Hi,

I cleaned up old version and reinstalled again but couldn't recreate the problem. Can you give more detailed log, especially from $SPLUNK_HOME/var/log/splunk/ta_opcua_*.log, it could be helpful for me to find the problem.

0 Karma

ggeihs03
New Member

From my log:...

time="2016-10-14T14:22:47-04:00" level=debug msg="endpoint: 0 [pass] - &opcua.EndpointDescription{EndpointURL:\"opc.tcp://mycomputerip:myport\", Server:opcua.ApplicationDescription{ApplicationURI:\"urn:Siemens.Automation.SimaticNET.S7:{9892DE7D-47C6-4543-A596-234B588F7090}\", ProductURI:\"Siemens/SimaticNet/OpcUaServer/S7\", ApplicationName:opcua.LocalizedText{Locale:\"en\", Text:\"OPC.SimaticNET.S7\"}, ApplicationType:0x0, GatewayServerURI:\"\", DiscoveryProfileURI:\"\", DiscoveryURLs:[]opcua.String{\"opc.tcp://mycomputerip:myport\"}}, ServerCertificate:opcua.ByteString{xxxxredactedxxxxx}, SecurityMode:0x3, SecurityPolicyURI:\"http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15\", UserIdentityTokens:[]opcua.UserTokenPolicy{opcua.UserTokenPolicy{PolicyID:\"Anonymous\", TokenType:0x0, IssuedTokenType:\"\", IssuerEndpointURL:\"\", SecurityPolicyURI:\"\"}, opcua.UserTokenPolicy{PolicyID:\"UserName\", TokenType:0x1, IssuedTokenType:\"\", IssuerEndpointURL:\"\", SecurityPolicyURI:\"http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15\"}}, TransportProfileURI:\"http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary\", SecurityLevel:0x82}" 
time="2016-10-14T14:22:47-04:00" level=debug msg="endpoint: 1 [select] - &opcua.EndpointDescription{EndpointURL:\"opc.tcp://mycomputerip:myport\", Server:opcua.ApplicationDescription{ApplicationURI:\"urn:Siemens.Automation.SimaticNET.S7:{9892DE7D-47C6-4543-A596-234B588F7090}\", ProductURI:\"Siemens/SimaticNet/OpcUaServer/S7\", ApplicationName:opcua.LocalizedText{Locale:\"en\", Text:\"OPC.SimaticNET.S7\"}, ApplicationType:0x0, GatewayServerURI:\"\", DiscoveryProfileURI:\"\", DiscoveryURLs:[]opcua.String{\"opc.tcp://mycomputerip:myport\"}}, ServerCertificate:opcua.ByteString{xxxxredacted}, SecurityMode:0x1, SecurityPolicyURI:\"http://opcfoundation.org/UA/SecurityPolicy#None\", UserIdentityTokens:[]opcua.UserTokenPolicy{opcua.UserTokenPolicy{PolicyID:\"Anonymous\", TokenType:0x0, IssuedTokenType:\"\", IssuerEndpointURL:\"\", SecurityPolicyURI:\"\"}, opcua.UserTokenPolicy{PolicyID:\"UserName\", TokenType:0x1, IssuedTokenType:\"\", IssuerEndpointURL:\"\", SecurityPolicyURI:\"http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15\"}}, TransportProfileURI:\"http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary\", SecurityLevel:0x0}" 
time="2016-10-14T14:22:47-04:00" level=debug msg="userIdentityToken: 0 [select] - opcua.UserTokenPolicy{PolicyID:\"Anonymous\", TokenType:0x0, IssuedTokenType:\"\", IssuerEndpointURL:\"\", SecurityPolicyURI:\"\"}" 
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...