Deployment Architecture

SNMP Modular Input setup for listening IPv6 traps fails

rajkiran8992
New Member

Hello All,
I am trying to setup my Splunk server to listen for IPv6 SNMP traps using the SNMP Modular Input app.

I used the SNMP Modular input app from the Splunk app store (https://splunkbase.splunk.com/app/1537/). I was able to setup Splunk to listen for IPv4 traps and everything seemed to be working fine. Later I added IPv6 address on the Splunk server and setup SNMP traps input for IPv6 and now I am not able to index any received traps.

I used tcpdump to check for the traps on the Splunk server and I am able to receive them.

On looking into the logs, I found:

04-07-2018 22:03:07.494 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Exception in thread Thread-1:
04-07-2018 22:03:07.494 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Traceback (most recent call last):
04-07-2018 22:03:07.494 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" File "/opt/splunk/lib/python2.7/threading.py", line 801, in __bootstrap_inner
04-07-2018 22:03:07.494 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" self.run()
04-07-2018 22:03:07.494 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" File "/opt/splunk/etc/apps/snmp_ta/bin/snmp.py", line 601, in run
04-07-2018 22:03:07.494 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" transport = udp.Udp6SocketTransport()
04-07-2018 22:03:07.494 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" AttributeError: 'module' object has no attribute 'Udp6SocketTransport'

Can someone help me out on this? Any response is highly appreciated.

Tags (1)
0 Karma

deepashri_123
Motivator

Hey@rajkiran8992,

What version of Splunk and Modular Input App are you using?

rajkiran8992
New Member

Hello Deepashri,

My Splunk version is 6.6.3 and Modular Input App is 1.2.3

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...