I am trying to feed Arcsight with the results of a Splunk search using the real time output app. I get the following error message.
_time log severity raw
21 7/17/14 4:35:36.214 PM rtoutput.log ERROR [Errno -2] Name or service not known Traceback (most recent call last): File "/opt/splunk/etc/apps/SplunkRealTimeOutput/bin/scripted_inputs/rtoutput.py", line 462, in asyncore.loop(use_poll=True) File "/opt/splunk/lib/python2.7/asyncore.py", line 216, in loop poll_fun(timeout, map) File "/opt/splunk/lib/python2.7/asyncore.py", line 201, in poll2 readwrite(obj, flags) File "/opt/splunk/lib/python2.7/asyncore.py", line 117, in readwrite obj.handle_error() File "/opt/splunk/lib/python2.7/asyncore.py", line 503, in handle_error self.handle_close() File "/opt/splunk/etc/apps/SplunkRealTimeOutput/bin/real_time_output/clients/httpsclient.py", line 235, in handle_close self.handle_parse_chunked(self.linebuffer) File "/opt/splunk/etc/apps/SplunkRealTimeOutput/bin/real_time_output/clients/httpsclient.py", line 333, in handle_parse_chunked self.reset_and_callback() File "/opt/splunk/etc/apps/SplunkRealTimeOutput/bin/real_time_output/clients/httpsclient.py", line 472, in reset_and_callback self.callback(result) File "/opt/splunk/etc/apps/SplunkRealTimeOutput/bin/scripted_inputs/rtoutput.py", line 330, in _cb_syslog sent = syslog.send(output.formatted_events) File "/opt/splunk/etc/apps/SplunkRealTimeOutput/bin/scripted_inputs/rtoutput.py", line 240, in send self.socket.sendto(message, self.address) gaierror: [Errno -2] Name or service not known
Question 1 - The search produces many fields. What happens when these fields not match with any of the CEF fields found ceftool.py? Should I restrict the numbers of fields from the search result to the ones that have a match in ceftool.py ?
Question 2 - the RTO app seems to provide different names than the ones found in ceftool.py?
Question 3 - What is the meaning of the listed error message?