All Apps and Add-ons

Cisco Networks App for Splunk Enterprise: Why do I receive "SFF8472-5-THRESHOLD_VIOLATION" messages?

_smp_
Builder

Hello. I am running Splunk version 6.5.1 with version 2.3.4 of the Cisco Networks App for Splunk Enterprise. I have a device generating SFF8472-5-THRESHOLD_VIOLATION messages. On the Cisco Networks Overview dashboard > Diagnostic Messages panel, the 'vendor_message_text' is being reported as this:

[char]: [char]; Operating value: [char], Threshold value: [char].

It seems that the lookup is referring to variables but being an inexperienced Splunk user, I'm not quite sure how this works. Should there be some text replacement going to insert variables from the event to make the lookup more meaningful?

0 Karma
1 Solution

mikaelbje
Motivator

Hi!

What you are seeing is by intent. The message text is just saying "this is the format these events look like". This is looked up in a CSV file for enrichment. This dashboard used to display the actual message text including the values, but since these values change so rapidly doing a count by actual message text would create a large stats table with a count of 1 for each row due to the uniqueness of each event.

So instead of using this to look at the actual event, look at the count. If you see rows with a high count (indicating values are changing or many events of this type are received) you can drill down to see the actual events and troubleshoot from there.

Mikael

View solution in original post

0 Karma

mikaelbje
Motivator

Hi!

What you are seeing is by intent. The message text is just saying "this is the format these events look like". This is looked up in a CSV file for enrichment. This dashboard used to display the actual message text including the values, but since these values change so rapidly doing a count by actual message text would create a large stats table with a count of 1 for each row due to the uniqueness of each event.

So instead of using this to look at the actual event, look at the count. If you see rows with a high count (indicating values are changing or many events of this type are received) you can drill down to see the actual events and troubleshoot from there.

Mikael

0 Karma

_smp_
Builder

OK, thanks for the clarification, and for the app!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...