It's me again. I'm able to find the problem and solve it. First I just did a search on the _internal index for my configured source. There I found this entry: ERROR TailingProcessor - Ignoring path due to: File will not be read, seekptr checksum did not match (file=/myfile/test.out). Last time we saw this initcrc, the filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue">http://www.splunk.com/page/submit_issue for more info. After I changed the Inputs.conf to this, [monitor:///splunk/ftp/cisco/cdr_*] disabled = false followTail = 0 host = cucm sourcetype = csv index = voice recursive = false followSymlink = false crcSalt = <SOURCE> I was able to index the files into splunk. yeeeeha!!! So the important thing which was missing is crcSalt = <SOURCE> . By the way, I changed the REGEX back to INTEGER. This works too. Thanks everybody for help. ... View more

Hi somesoni2, yes I place the props.conf and transforms.conf on the indexer. We only have a universal forwarder running for windows events but in this case it is not used. For the specific cdr logs I configured our voice environment to send the data by sftp through our splunk indexer. Yes I always restart the splunk service by typing service splunk restart on the command line. 😉 I didn't see any errors, regarding misconfiguration of *.conf files. So I gues that my configuration is fine. I tried your REGEX and a DEST_KEY with lower letters, but it didn't solf the problem. If I place a new file into the folder which is monitored by splunk, splunk will do nothing. Do you have any idea how I can debug it? Thanks ... View more

Hi DaIJeanis, thanks for you answer. Unfortunately with your REGEX it will also not work. If I manually remove the line which starts with INTEGER,... the file will be indexed. But this is not the goal for me. ... View more

Hi, I just test your suggestion, but with your configuration the fields are not present in splunk. Instead of that you will find fields like INTEGER, VARCHAR and so on. So for me is not a working solution. Does somebody found another way? ... View more

Hi, I'm in the same situation. I have to "remove"/"delete"/"ignore" the second line of the csv file. My configuration looks like this: inputs.conf [Monitor://splunk/ftp/cisco/cdr_*] disabled = false followTail = 0 host = <hostname> sourcetype = csv index = voice recursive = false followSymlink = false transforms.conf [eliminate_line_cdr] REGEX=^INTEGER.* DEST_KEY = Queue FORMAT = nullQueue props.conf [source::/splunk/ftp/cisco/cdr_*] TRANSFORMS-cisco_voice_cdr = eliminate_line_cdr Could somebody tell me, where I do a mistake? For me it looks good, but it will not work. FYI: the configuration files are located on the splunk indexer. The same for the cdr_* files. Any idea would be helpful. Thanks ... View more

hi Giuseppe, thanks for your answer. Indeed I have to enter the following entry to my transforms.conf and props.conf. transforms.conf [change_host_cuc] SOURCE_KEY = _raw REGEX = \<\d+\>[\d\s]+\:[\d\s]+\:[\d\s]+\:[\d\s]+\:\s(cuc\d+[^:]*): DEST_KEY = MetaData:Host FORMAT = host::$1 WRITE_META = true props.conf [syslog] ... TRANSFORMS-cuc = change_host_cuc ... So your idea to change the regex was perfect. Many thanks for this. Could you tell me also how to change the timeformat for the events during indexing? As you can see, the event is in US timeformat but all other events are in 24h Format. If it's possible I'd like to uniform this. Kind regards ... View more

Hi, I have a similar problem with remote WMI requests. We just have set on the remote server a static port for WMI requests. Seems to be working fine. But we noticed on a third party firewall that splunk forwarder tries to connect by other ports then defined on the remote server. Is there any configuration on the forwarder possible, like a WMI port configuration or something like that? With the documentation, I couldn't find any Information about this. I know that WMI is not a splunk issue, but maybe we can manipulate it by splunk. 🙂 ... View more

@Iguinn, thanks for your answer. That's exactly what I'm searching for. Unfortunately I didn't completly understood the manual with these settings in the indexes.conf section. One short question about the maxTotalDataSizeMB setting. If I set it to auto , I should be on the safe side? So the index can grow like it wants and with the other two settings you described, I should be safe that each day the bucket will be rolled. My problem is, that the amount of data input for the differnt indexes are not the same each day. So I could count how many MB is right for the indexes. In that case it makes sense to me to set the value to auto. For your information, the disk space for the indexer is big enough, so we should not get trouble with it. Kind regards, and once again thanks for your reply. ... View more

Hi Damien, thanks for you support. I implement a new responsehandler and with this I can modify the incoming traps. Regards, Tom ... View more

I finaly found out how to fix the problem with the special characters. Now I tried to implement the solution into a custom reponse handler. I just copy the original responsehandlers.py script and add my changes and save it as responsehandlers_test.py. Then I go to the frontend and include responsehandlers_test into the field "Response Handler". Should be right?! Do I have to do something else? If I have a look into the splunkd.log I see this ERROR message. 03-16-2015 13:17:02.035 +0100 ERROR ExecProcessor - message from "python /splunk/opt/splunk/etc/apps/snmp_ta/bin/snmp.py" AttributeError: 'module' object has no attribute 'responsehandlers_test' Something went wrong but I've no idea what and where. Which attribute does snmp.py expect? Unfortunately there is no further documentation where I can read something about the process in the Background. 😞 ... View more

Me again, I found out that the problem is how the snmp.py script handle the data. The module pyasn1 from python is responsible to decode the values of the snmp data. This module could only handle "normal" characters in this values. If there is a line-feed or some other special character the module didn't translate the data. It will only shown as a hex value. I tried to do some testing with a shorter script on my testing server but since I'm no python expert I'm not able to fix the problem. @Damien, could you please check if it is possible to implement a check for special characters? I tried something like this: if isinstance(val, OctetString): val = val.asOctets() With asOctets() you are able to read also the special charaters. ... View more

Today I did a short test on another linux server. I configured this server that the snmp Events are stored in a file. When I start grabbing the events from the application I can read all of them. But I can't see any line feeds. For me the problem is located at the SNMP Mod Input trap listener. Is it possible to modify this listener to get some debug output? I see that you do some replacements in the responsehandlers.py script. Is it right that you search into to raw data for the special characters ("&", "\n", ... ) ? ... View more

Yes indeed, it's a progress. 😉 I just thinking about a Workaround but not sure if it could work or not. When the snmp event receives the splunk indexer, does the transform.conf and props.conf working before the snmp.py script runs? If yes, then I could try to search and replace for the line feeds and wordwraps in the events. Do you think that makes sense? I know that you couldn't know any MIB file. And I'm really happy that you nevertheless try to find a solution for my problem. Thank you very much for this help! ... View more

If I read the mib file correct then the part of interest is this one. saaEventDescription OBJECT-TYPE SYNTAX OCTET STRING ACCESS read-only STATUS mandatory DESCRIPTION "Event description" ::= { saatrap 9 } That describes the discription where multi-line data is in. Is it right, that the SYNTAX "OCTET STRING" can handle such multi-line events? I could not find any explanations which SYNTAX should be used to handle multi-line events. Have you any idea or tip? ... View more

I follow the instruction of the provided link. But now I got a couple of other error Messages in splunkd.log ERROR ExecProcessor - message from "python /splunk/opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Exception resolving MIB value in the caught trap: ConstraintsIntersection(ConstraintsIntersection(ConstraintsIntersection(), ValueSizeConstraint(0, 65535)), ValueSizeConstraint(9, 9)) failed at: "ValueSizeConstraint(9, 9) failed at: "ObjectSyntax().setComponentByPosition(0, SimpleSyntax().setComponentByPosition(1, OctetString('10:48:02')))"" at OctetString snmp_stanza:snmp://SWIFT_EVENT And unfortunately the main problem still exists. The muli-line events are still shown in hex. ... View more

3) Until now I didn't use any line breaking rules. I read the article behind your link, but I'm not sure how to configure it right. I think I have to play a littel bit with the configuration. I think that snmp.py expect "0d0a" (DOS newline character) but the application sends "0a" as the newline character which the snmp.py didn't understand. Could this be the Problem? ... View more

Hi Damien, thanks for you quick reply. Yes we are sending text. All other events are looking good. Only the multi-line events are not fine. 1) We saw a lot of error messages in splunkd.log. But this happens because of the missing custom MIB file. As you can see in the link we are not able to generate a custom mib.py file for the swift mibs. I tried everything but nothing works so far. Error Messages: - ERROR ExecProcessor - message from "python /splunk/opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Exception resolving MIB value in the caught trap: local variable 'modName' referenced before assignment snmp_stanza:snmp://SWIFT_EVENT - ERROR ExecProcessor - message from "python /splunk/opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Exception resolving MIB name in the caught trap: NoSuchObjectError({'str': 'No MIB registered that defines 1.3.6.1.4.1.18494.2.1.9 object, closest known parent is 1.3.6.1.4.1 (SNMPv2-SMI::enterprises)'}) snmp_stanza:snmp://SWIFT_EVENT 2) Hex value, indexed by splunk: 0x4175746f6d61746963204261636b7570206f66206d65737361676520617263686976652873290a443a5c4241434b55505c4d46415c4d4541525f32303135303232320a7375636365737366756c6c7920636f6d706c657465642e Readable message (with newlines): Automatic Backup of message archive(s) D:\BACKUP\MFA\MEAR_201502222 successfully completed. ... View more

Thanks kumor, I compare your SAATRAP.py with mine. Both are absolutly equal to each other. @Damien, have you any idea how we can proceed with this issue? Only for you Information. I downloaded the RFC-1212 MIB and save it with the filename RFC-1212.txt. Then I executed this command: smidump -k -f python RFC-1212.txt | libsmi2pysnmp > RFC-1212.py without any Errors. I try to Import this into my Inputs.conf file. The result is, that I've got this error message in splunkd.log. 01-16-2015 13:53:00.477 +0100 ERROR ExecProcessor - message from "python /splunk/opt/splunk/etc/apps/snmp_ta/bin/snmp.py" pysnmp.smi.error.SmiError: MIB module "/splunk/opt/splunk/etc/apps/snmp_ta/bin/mibs/SAGTRAP.py" load error: ['Traceback (most recent call last):\n', ' File "/splunk/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n exec(modData, g)\n', ' File "<string>", line 11, in <module>\n', ' File "/splunk/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 302, in importSymbols\n \'No module %s loaded at %s\' % (modName, self)\n', 'SmiError: No module RFC-1212 loaded at <pysnmp.smi.builder.MibBuilder instance at 0x7ffe9af00560>\n'] Where is my mistake? ... View more

Are there any news regarding this problem? I still have similar issues. @kumor, is it possible that you post the saatrap.py? ... View more

Me again, I still have found out my mistake. As I said in my answer, I had to stop the snmptrapd process and now I see data in splunk. But until I saw data in splunk search I have a problem with my custom MIB. In the splunkd.log I got this error message: 01-15-2015 12:32:31.802 +0100 ERROR ExecProcessor - message from "python /splunk/opt/splunk/etc/apps/snmp_ta/bin/snmp.py" pysnmp.smi.error.SmiError: MIB module "/splunk/opt/splunk/etc/apps/snmp_ta/bin/mibs/SAATRAP.py" load error: ['Traceback (most recent call last):\n', ' File "/splunk/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n exec(modData, g)\n', ' File "<string>", line 7, in <module>\n', ' File "/splunk/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 294, in importSymbols\n \'importSymbols: empty MIB module name\'\n', 'SmiError: importSymbols: empty MIB module name\n'] Is there a way to check my py file? Is there another logfile where I can find some more Information? Thanks. ... View more

Hi there, today I installed the SPLUNK SNMP APP on our indexer/searchhead. After I had restarted the splunk service I configured a stanza in inputs.conf to collect SNMP traps. [snmp://TEST_EVENT] communitystring = public do_bulk_get = 0 do_get_subtree = 0 index = test ipv6 = 0 snmp_mode = traps snmp_version = 1 sourcetype = snmp split_bulk_output = 0 trap_rdns = 1 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol trap_host = SERVERNAME trap_port = 162 Behind that I configured a server to send traps to the Splunk SH/Indexer. I checked the splunkd.log and found the following ERROR message. 01-15-2015 08:46:55.054 +0100 ERROR ExecProcessor - message from "python /splunk/opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Failed to register transport and run dispatcher: bind() for (u'SERVERNAME', 162) failed: [Errno 98] Address already in use snmp_stanza:snmp://TEST_EVENT I tried differnet trap_host definitions (SERVERNAME, IP address, SERVERNAME.domain). But nothing works. Does anybody have had the same problems? Could the problem occurs because of running snmptrapd and snmptt on the server? snmp 14758 1 0 Jan14 ? 00:00:22 /usr/sbin/snmpd -Lsd -Lf /dev/null -u snmp -g snmp -I -smux mteTrigger mteTriggerConf -p /var/run/snmpd.pid snmptt 14760 1 0 Jan14 ? 00:00:01 /usr/sbin/snmptrapd -Lsd -Lf /var/log/snmptt/snmptt.log -On -C -c /etc/snmp/snmptrapd.conf -p /var/run/snmptrapd.pid -u snmptt root 17440 1 0 Jan14 ? 00:00:00 /usr/bin/perl /usr/sbin/snmptt --daemon snmptt 17441 17440 0 Jan14 ? 00:00:05 /usr/bin/perl /usr/sbin/snmptt --daemon I did this because my first try was to collect all the traps in a dedicated file and then read the file from splunk process. It would be very nice if someone can help me and explain where the problem is. ... View more