Splunk Observability Cloud

Splunk Otel smartagent/snmp

mnegron1
Engager

When setting up this receiver,  otel fails to start with this msg:

Error: failed to resolving: yaml: line 89: did not find expected key

Line 89 is smartagent/snmp:

below is the collector config for this snmp block in otel

smartagent/snmp:
  type: telegraf/snmp
  agents:
       - "172.xx.11.xx:xx2"
   version: 2
  community: "public"
  fields:
     name: "uptime"
    oid: ".1.3.6.1.2.1.1.3.0"

0 Karma

mnegron1
Engager

Thank you,

config is attached ... I've obscured the ip... 

 

Here's the log 

 

Apr 11 16:44:00  otelcol[142312]: 2024/04/11 16:44:00 main.go:89: application run finished with error: failed to resolve config: cannot resolve the configuration: cannot retrieve the configuration: configsource provider failed retrieving: yaml: line 91
: did not find expected key
Apr 11 16:44:00 systemd[1]: splunk-otel-collector.service: Main process exited, code=exited, status=1/FAILURE
Apr 11 16:44:00 systemd[1]: splunk-otel-collector.service: Failed with result 'exit-code'.
Apr 11 16:44:01 systemd[1]: splunk-otel-collector.service: Scheduled restart job, restart counter is at 5.
Apr 11 16:44:01 systemd[1]: Stopped Splunk OpenTelemetry Collector.
Apr 11 16:44:01 systemd[1]: splunk-otel-collector.service: Start request repeated too quickly.
Apr 11 16:44:01  systemd[1]: splunk-otel-collector.service: Failed with result 'exit-code'.
Apr 11 16:44:01 systemd[1]: Failed to start Splunk OpenTelemetry Collector.

0 Karma

bishida
Splunk Employee
Splunk Employee

I'm a little suspicious of the formatting after the line:
community: "public"

Could you try adjusting so it's like this?

community: "public"
fields:
  - name: "some_name"
    oid: "x.x.x.x.x.x.x.x.x.x.x.x.x"



If that doesn't help, if you could email me the agent_config.yaml, I'll take a closer look (the pdf kills the indentation). Just add "@splunk.com" to my username if you want to send it. Thanks!

0 Karma

bishida
Splunk Employee
Splunk Employee

Hi,

 

Are you using the Splunk distribution of the OTel collector? You'll need it to use the smartagent receivers I think.  Here is a working example. Please note all the indentation since yaml is picky. If you want to share your agent_config.yaml, that may help.

 

snmp.png

0 Karma

mnegron1
Engager

I am in fact using the Splunk Otel Collector and have validated the indentation.

0 Karma

bishida
Splunk Employee
Splunk Employee

Happy to take a look if you can share your agent_config.yaml file.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...