Cisco Networks App for Splunk Enterprise: Why do I receive "SFF8472-5-THRESHOLD_VIOLATION" messages?

[_smp_]

Hello. I am running Splunk version 6.5.1 with version 2.3.4 of the Cisco Networks App for Splunk Enterprise. I have a device generating SFF8472-5-THRESHOLD_VIOLATION messages. On the Cisco Networks Overview dashboard > Diagnostic Messages panel, the 'vendor_message_text' is being reported as this:

[char]: [char]; Operating value: [char], Threshold value: [char].

It seems that the lookup is referring to variables but being an inexperienced Splunk user, I'm not quite sure how this works. Should there be some text replacement going to insert variables from the event to make the lookup more meaningful?

[mikaelbje · Accepted solution]

Hi!

What you are seeing is by intent. The message text is just saying "this is the format these events look like". This is looked up in a CSV file for enrichment. This dashboard used to display the actual message text including the values, but since these values change so rapidly doing a count by actual message text would create a large stats table with a count of 1 for each row due to the uniqueness of each event.

So instead of using this to look at the actual event, look at the count. If you see rows with a high count (indicating values are changing or many events of this type are received) you can drill down to see the actual events and troubleshoot from there.

Mikael

[_smp_]

OK, thanks for the clarification, and for the app!