Problems with datas

[Yann_T]

Hello,
I'm using this to monitor my access points.
I want to check the number of clients connected on each access point.
But I have some difficulties to see all of them.
For example, I know there are about 50 clients (client is a device, a smartphone or a laptop) but with this app I can see only 34.
I don't know why.
What I'm suppose to do in order to see all my clients ?

[Yann_T]

In my firm, I have 13 access point wich cover all stage. People can connect on it and I want to have statistics about it.
That is why I'm using this App.
My access points are Aruba's. So to try my mibs, I downloaded a mibbrowser. When I use it I can see all clients for example I have got 3 devices connected on 2 differents network.
When I execute a snmp request with the mib browser, I can see all of them.
But when I do it with the snmp app i can see only one.

here my inputs.conf :

[snmp://UserName]
communitystring = public
destination = 10.1.1.250
do_bulk_get = 1
index = snmp
ipv6 = 0
mib_names = ARUBA-MIB
object_names = .1.3.6.1.4.1.14823.2.2.1.1.2.1.1.3.0
port = 161
snmp_mode = attributes
snmp_version = 2C
snmpinterval = 30
sourcetype = logsnmp_username
split_bulk_output = 1
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol
disabled = 0

[snmp://UserRole]
communitystring = public
destination = 10.1.1.250
do_bulk_get = 1
index = snmp
ipv6 = 0
mib_names = ARUBA-MIB
object_names = .1.3.6.1.4.1.14823.2.2.1.4.1.2.1.4.0
port = 161
snmp_mode = attributes
snmp_version = 2C
snmpinterval = 30
sourcetype = logsnmp_userrole
split_bulk_output = 1
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol
disabled = 0

[snmp://UserUpTime]
communitystring = public
destination = 10.1.1.250
do_bulk_get = 1
index = snmp
ipv6 = 0
mib_names = ARUBA-MIB
object_names = .1.3.6.1.4.1.14823.2.2.1.4.1.2.1.5.0
port = 161
snmp_mode = attributes
snmp_version = 2C
snmpinterval = 30
sourcetype = logsnmp_useruptime
split_bulk_output = 1
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol
disabled = 0

[snmp://UserApLocation]
communitystring = public
destination = 10.1.1.250
do_bulk_get = 1
index = snmp
ipv6 = 0
mib_names = ARUBA-MIB
object_names = .1.3.6.1.4.1.14823.2.2.1.4.1.2.1.10
port = 161
snmp_mode = attributes
snmp_version = 2C
snmpinterval = 30
sourcetype = logsnmp_useraplocation
split_bulk_output = 1
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol
disabled = 0

[snmp://DeviceType]
communitystring = public
destination = 10.1.1.250
do_bulk_get = 1
index = snmp
ipv6 = 0
mib_names = ARUBA-MIB
object_names = .1.3.6.1.4.1.14823.2.2.1.4.1.2.1.39.0
port = 161
snmp_mode = attributes
snmp_version = 2C
snmpinterval = 30
sourcetype = logsnmp_devicetype
split_bulk_output = 1
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol
disabled = 0

[snmp://user_snr]
communitystring = public
destination = 10.1.1.250
do_bulk_get = 1
index = snmp
ipv6 = 0
mib_names = ARUBA-MIB
object_names = .1.3.6.1.4.1.14823.2.2.1.1.2.2.1.7
port = 161
snmp_mode = attributes
snmp_version = 2C
snmpinterval = 30
sourcetype = logsnmp_user_snr
split_bulk_output = 1
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol
disabled = 1

[snmp://userRxData]
communitystring = public
destination = 10.1.1.250
do_bulk_get = 1
index = snmp
ipv6 = 0
mib_names = ARUBA-MIB
object_names = .1.3.6.1.4.1.14823.2.2.1.4.1.2.1.42.0
port = 161
snmp_mode = attributes
snmp_version = 2C
snmpinterval = 30
sourcetype = logsnmp_userRxData
split_bulk_output = 1
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol
disabled = 0

[snmp://ApActive]
communitystring = public
destination = 10.1.1.250
do_bulk_get = 1
index = snmp
ipv6 = 0
mib_names = ARUBA-MIB
object_names = .1.3.6.1.4.1.14823.2.2.1.1.3.1.0
port = 161
snmp_mode = attributes
snmp_version = 2C
snmpinterval = 30
sourcetype = logsnmp_apactive
split_bulk_output = 1
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol
disabled = 1

[Yann_T]

04-30-2014 09:39:50.594 +0200 ERROR SearchParser - Missing a search command before '''.

[Yann_T]

I've got these warn too :

4-29-2014 07:09:03.287 +0200 WARN DatabaseDirectoryManager - Failed getting size of path='/opt/splunk/var/lib/splunk/_internaldb/db/hot_v1_25/1398748141-1398748141-17881382023628152521.pre-tsidx': No such file or directory

04-29-2014 20:12:54.237 +0200 WARN DateParserVerbose - A possible timestamp match (Wed Apr 16 22:50:02 2008) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://userRxData|host::10.1.1.250|logsnmp_userRxData|139711641420800

[Yann_T]

I'm using this search string : "index=snmp source="snmp://useraplocation" | join ipaddress [search index=snmp source="snmp://username"] | join ipaddress [search index=snmp source="snmp://userrole"] | dedup ipaddress | table _time, ipaddress, username, borne, ssid"
on a real-time 30 second window.
2) Indeed I've got this error :
04-28-2014 16:36:53.268 +0200 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" No SNMP response received before timeout snmp_stanza:snmp://userRxData snmp_destination:10.1.1.250 snmp_port:161

[Damien_Dallimor]

1) what search string are you using ? What time frame are you searching over ?

2) are there any errors ? ( search "index=_internal ExecProcessor error snmp.py" )

[Damien_Dallimor]

Could you please describe the issue in more detail and also post a copy of your setup (snmp stanzas from inputs.conf)