Deployment Architecture

Why am I getting the following error between Eventgen and a Netapp Ontap entry?: "not well-formed (invalid token): line 1, column 6"

freflex
New Member

I have installed Splunk 7.2 and Evengen 6.2.1 and I want to generate events for NetApp Ontap entry. I have run the following command from the terminal windows to verify the error:

splunk cmd python ../SA-Eventgen/bin/modinput_eventgen.py --username  --password  --infile samples/ontap_aggrinv_cmode.csv

Here is the error:
not well-formed (invalid token): line 1, column 6

Here is the eventgen.conf file:
[global]
count = 1
maxIntervalsBeforeFlush = 1
splunkHost = localhost
splunkUser = xxxxxxxx
splunkPass = xxxxxxxx

[ontap_aggrinv_cmode.csv]
mode = replay
sampletype = csv
outputMode = splunkstream

Sample data contains last 15 mins of data

timeMultiple = 1
timeField = time

2013-08-22 19:34:49

token.0.token = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}
token.0.replacementType = timestamp
token.0.replacement = %Y-%m-%d %H:%M:%S

Example entry:

   "_raw",host,index,source,sourcetype,time
    "{""disk-types"": ""520"", ""max-named-disks-per-request"": ""128"", ""min-aggr-disk-count"": {""min-aggr-disk-count-info"": [{""minimum-disk-count"": ""1"", ""raid-type"": ""raid0""}, {""minimum-disk-count"": ""3"", ""raid-type"": ""raid4""}, {""minimum-disk-count"": ""5"", ""raid-type"": ""raid_dp""}, {""minimum-disk-count"": ""7"", ""raid-type"": ""raid_tec""}]}, ""default-raidtype-config"": {""default-raidtype-config-info"": {""disk-type"": ""FCAL"", ""default-raid-type"": ""raid_dp""}}, ""snapshots-max"": ""255"", ""default-raidtype"": ""raid_dp"", ""checksum-types"": ""block"", ""raidgroup-size"": {""raidgroup-size-info"": [{""maximum-size"": ""14"", ""disktype"": ""FCAL"", ""minimum-size"": ""2"", ""raidtype"": ""raid4"", ""default-size"": ""8""}, {""maximum-size"": ""28"", ""disktype"": ""FCAL"", ""minimum-size"": ""3"", ""raidtype"": ""raid_dp"", ""default-size"": ""16""}, {""maximum-size"": ""29"", ""disktype"": ""FCAL"", ""minimum-size"": ""4"", ""raidtype"": ""raid_tec"", ""default-size"": ""24""}]}, ""node"": ""cluster-9-01"", ""allowed-raidtypes"": {""raidtype-info"": [{""raidtype"": ""raid0""}, {""raidtype"": ""raid4""}, {""raidtype"": ""raid_dp""}, {""raidtype"": ""raid_tec""}]}, ""root-volume"": ""vol0""}","10.0.1.39",ontap,"aggr-get-filer-info","ontap:aggr","2016-12-05 14:53:49"
0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...