no problem, my mistake when i published. ... View more

fmc will set event_sec i believe. if that field (or another timestamp) is not there it should get the files timestamp. I have also seen issue with flow start/end times vs. event time for the connection events , which I dont see in your sample. best of luck! i am anxious yo know if eNcore can keep up with high volume flows. ... View more

i have not personally used eNcore yet. nor can i confirm it reports SFIM or IPS. But you can start by using this SPL search. index=* source=encore* ... View more

ive tracked this down to a char set problem file lands on the splunk server UTF8 unicode attaching some screen caps showing the bad chars ... View more

logging is better, do i need hostname as opposed to IP? message message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" file="snmpif.py" line=195 stanza="snmpif://XXX.XXX.XXX.XXX" msg="Exception in main loop" message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" Traceback (most recent call last): message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "/opt/splunk/etc/apps/snmpmod/bin/snmpif.py", line 185, in do_run message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" var_binds = snmputils.query_oids(cmd_gen, snmpif.security_object(), snmpif.transport(), oid_args) message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "/opt/splunk/etc/apps/snmpmod/bin/snmputils.py", line 79, in query_oids message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" snmp_result = cmd_gen.getCmd(security_object, transport, *oids) message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "/opt/splunk/etc/apps/snmpmod/bin/pysnmp-4.3.2-py2.7.egg/pysnmp/entity/rfc3413/oneliner/cmdgen.py", line 181, in getCmd message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" **kwargs): message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "/opt/splunk/etc/apps/snmpmod/bin/pysnmp-4.3.2-py2.7.egg/pysnmp/hlapi/asyncore/sync/cmdgen.py", line 107, in getCmd message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" lookupMib=options.get('lookupMib', True))) message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "/opt/splunk/etc/apps/snmpmod/bin/pysnmp-4.3.2-py2.7.egg/pysnmp/hlapi/asyncore/cmdgen.py", line 122, in getCmd message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" addrName, paramsName = lcd.configure(snmpEngine, authData, transportTarget) message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "/opt/splunk/etc/apps/snmpmod/bin/pysnmp-4.3.2-py2.7.egg/pysnmp/hlapi/lcd.py", line 44, in configure message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" authData.securityName message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "/opt/splunk/etc/apps/snmpmod/bin/pysnmp-4.3.2-py2.7.egg/pysnmp/entity/config.py", line 71, in addV1System message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" ((snmpCommunityEntry.name + (8,) + tblIdx, 'destroy'),) message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "/opt/splunk/etc/apps/snmpmod/bin/pysnmp-4.3.2-py2.7.egg/pysnmp/smi/instrum.py", line 250, in writeVars message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" return self.flipFlopFsm(self.fsmWriteVar, vars, acInfo) message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "/opt/splunk/etc/apps/snmpmod/bin/pysnmp-4.3.2-py2.7.egg/pysnmp/smi/instrum.py", line 218, in flipFlopFsm message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" rval = f(tuple(name), val, idx, acInfo) message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "", line 470, in writeTest message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "", line 1117, in writeTest message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "", line 1088, in __delegate message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "", line 886, in writeTest message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "", line 793, in createTest message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "", line 699, in createTest message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "", line 591, in setValue message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" File "", line 289, in setValue message from "python /opt/splunk/etc/apps/snmpmod/bin/snmpif.py" AttributeError: RowStatus instance has no attribute 'hasValue' ... View more

nicely done ... View more

have you solved this issue? i and trying to do the same thing. thanks in advance! ... View more

the sample gateway .props creates a '!' delimited key/value flatfile. each alerts.status action dumps all values for that row. the TA-tivoli_netcool_object_server then parses all key/value pairs via KV_MODE = auto_escaped. ... View more

build your query then "| sendemail to=me@domain.com" .... ... View more

to help troubleshoot ... i would create the report then "| sendemail to=blah@hotmail.com" you will see any errors in mail config there. It won't tell you if its being blocked, but if it completes without error. recently, i have seen the requirement for a host fqdn in $splunk_home/etc/system/local/alert_actions.conf ... View more

This happened to me during beta, I had obtained the wrong version. Are you on Linux 64 bit? ... View more