Deployment Architecture

Why am I getting the following error between Eventgen and a Netapp Ontap entry?: "not well-formed (invalid token): line 1, column 6"

freflex
New Member

I have installed Splunk 7.2 and Evengen 6.2.1 and I want to generate events for NetApp Ontap entry. I have run the following command from the terminal windows to verify the error:

splunk cmd python ../SA-Eventgen/bin/modinput_eventgen.py --username  --password  --infile samples/ontap_aggrinv_cmode.csv

Here is the error:
not well-formed (invalid token): line 1, column 6

Here is the eventgen.conf file:
[global]
count = 1
maxIntervalsBeforeFlush = 1
splunkHost = localhost
splunkUser = xxxxxxxx
splunkPass = xxxxxxxx

[ontap_aggrinv_cmode.csv]
mode = replay
sampletype = csv
outputMode = splunkstream

Sample data contains last 15 mins of data

timeMultiple = 1
timeField = time

2013-08-22 19:34:49

token.0.token = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}
token.0.replacementType = timestamp
token.0.replacement = %Y-%m-%d %H:%M:%S

Example entry:

   "_raw",host,index,source,sourcetype,time
    "{""disk-types"": ""520"", ""max-named-disks-per-request"": ""128"", ""min-aggr-disk-count"": {""min-aggr-disk-count-info"": [{""minimum-disk-count"": ""1"", ""raid-type"": ""raid0""}, {""minimum-disk-count"": ""3"", ""raid-type"": ""raid4""}, {""minimum-disk-count"": ""5"", ""raid-type"": ""raid_dp""}, {""minimum-disk-count"": ""7"", ""raid-type"": ""raid_tec""}]}, ""default-raidtype-config"": {""default-raidtype-config-info"": {""disk-type"": ""FCAL"", ""default-raid-type"": ""raid_dp""}}, ""snapshots-max"": ""255"", ""default-raidtype"": ""raid_dp"", ""checksum-types"": ""block"", ""raidgroup-size"": {""raidgroup-size-info"": [{""maximum-size"": ""14"", ""disktype"": ""FCAL"", ""minimum-size"": ""2"", ""raidtype"": ""raid4"", ""default-size"": ""8""}, {""maximum-size"": ""28"", ""disktype"": ""FCAL"", ""minimum-size"": ""3"", ""raidtype"": ""raid_dp"", ""default-size"": ""16""}, {""maximum-size"": ""29"", ""disktype"": ""FCAL"", ""minimum-size"": ""4"", ""raidtype"": ""raid_tec"", ""default-size"": ""24""}]}, ""node"": ""cluster-9-01"", ""allowed-raidtypes"": {""raidtype-info"": [{""raidtype"": ""raid0""}, {""raidtype"": ""raid4""}, {""raidtype"": ""raid_dp""}, {""raidtype"": ""raid_tec""}]}, ""root-volume"": ""vol0""}","10.0.1.39",ontap,"aggr-get-filer-info","ontap:aggr","2016-12-05 14:53:49"
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...