All Apps and Add-ons

Why doesn't the SolarWinds Add-on for Splunk always process all imported data?

shudv_2
New Member

I have successfully setup the add-on (as I thought).
I have setup the app with a query that runs every 24 hours and gets all the subnets from IPAM Solarwinds.
And it worked for a couple of days.
But one day I noticed that out of 1267 nets available in IPAM it imported only 215. Yet the other day it imported all of the nets successfully.
Checking my query with SWQL Studio always returned all the available 1267 subnets. So I believe it is not the query problem.
If a disable and enable the input I created in the add-on (to rerun it) after one or two hits it imports all the subnets. That's very odd.
Turning on debugging and examining the add-on log did not reveal any errors. The output is just the same when it gets all the records and when it doesn't.
The other strange thing I noticed is that when I enable the input and look at the Splunk search in real-time I see the following "215 of 1267 events matched". That is what I see when not all of the events get imported from IPAM.
Could you some help.
Thanks in advance!

0 Karma

niemesrw
Path Finder

I have an identical one running in a python script that returns around 26k values, however the exact same query in the app only returns around 14k values. I also enabled debug logging & don't see any errors.

My query is as follows:
SELECT IPAddress AS ip, SubnetId, DhcpClientName as dns, ToLower(MAC) AS mac FROM IPAM.IPNode WHERE mac IS NOT NULL

Python code:
qr = swis.query("SELECT IPAddress AS ip, SubnetId, DhcpClientName as dns, ToLower(MAC) AS mac FROM IPAM.IPNode WHERE mac IS NOT NULL")

Any advice on next steps to troubleshoot would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...