Splunk Observability Cloud

Splunk Otel smartagent/snmp

mnegron1
Engager

When setting up this receiver,  otel fails to start with this msg:

Error: failed to resolving: yaml: line 89: did not find expected key

Line 89 is smartagent/snmp:

below is the collector config for this snmp block in otel

smartagent/snmp:
  type: telegraf/snmp
  agents:
       - "172.xx.11.xx:xx2"
   version: 2
  community: "public"
  fields:
     name: "uptime"
    oid: ".1.3.6.1.2.1.1.3.0"

0 Karma

mnegron1
Engager

Thank you,

config is attached ... I've obscured the ip... 

 

Here's the log 

 

Apr 11 16:44:00  otelcol[142312]: 2024/04/11 16:44:00 main.go:89: application run finished with error: failed to resolve config: cannot resolve the configuration: cannot retrieve the configuration: configsource provider failed retrieving: yaml: line 91
: did not find expected key
Apr 11 16:44:00 systemd[1]: splunk-otel-collector.service: Main process exited, code=exited, status=1/FAILURE
Apr 11 16:44:00 systemd[1]: splunk-otel-collector.service: Failed with result 'exit-code'.
Apr 11 16:44:01 systemd[1]: splunk-otel-collector.service: Scheduled restart job, restart counter is at 5.
Apr 11 16:44:01 systemd[1]: Stopped Splunk OpenTelemetry Collector.
Apr 11 16:44:01 systemd[1]: splunk-otel-collector.service: Start request repeated too quickly.
Apr 11 16:44:01  systemd[1]: splunk-otel-collector.service: Failed with result 'exit-code'.
Apr 11 16:44:01 systemd[1]: Failed to start Splunk OpenTelemetry Collector.

0 Karma

bishida
Splunk Employee
Splunk Employee

I'm a little suspicious of the formatting after the line:
community: "public"

Could you try adjusting so it's like this?

community: "public"
fields:
  - name: "some_name"
    oid: "x.x.x.x.x.x.x.x.x.x.x.x.x"



If that doesn't help, if you could email me the agent_config.yaml, I'll take a closer look (the pdf kills the indentation). Just add "@splunk.com" to my username if you want to send it. Thanks!

0 Karma

bishida
Splunk Employee
Splunk Employee

Hi,

 

Are you using the Splunk distribution of the OTel collector? You'll need it to use the smartagent receivers I think.  Here is a working example. Please note all the indentation since yaml is picky. If you want to share your agent_config.yaml, that may help.

 

snmp.png

0 Karma

mnegron1
Engager

I am in fact using the Splunk Otel Collector and have validated the indentation.

0 Karma

bishida
Splunk Employee
Splunk Employee

Happy to take a look if you can share your agent_config.yaml file.

0 Karma
Get Updates on the Splunk Community!

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...

New This Month - SLO Capabilities, APM Advanced Filtering & Usage Analytics Plus ...

More for SLO Management We’re continuing to expand the built-in SLO management experience in Splunk ...

Enterprise Security Content Update (ESCU) | New Releases

In June, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...