Deployment Architecture

Why am I getting the following error between Eventgen and a Netapp Ontap entry?: "not well-formed (invalid token): line 1, column 6"

freflex
New Member

I have installed Splunk 7.2 and Evengen 6.2.1 and I want to generate events for NetApp Ontap entry. I have run the following command from the terminal windows to verify the error:

splunk cmd python ../SA-Eventgen/bin/modinput_eventgen.py --username  --password  --infile samples/ontap_aggrinv_cmode.csv

Here is the error:
not well-formed (invalid token): line 1, column 6

Here is the eventgen.conf file:
[global]
count = 1
maxIntervalsBeforeFlush = 1
splunkHost = localhost
splunkUser = xxxxxxxx
splunkPass = xxxxxxxx

[ontap_aggrinv_cmode.csv]
mode = replay
sampletype = csv
outputMode = splunkstream

Sample data contains last 15 mins of data

timeMultiple = 1
timeField = time

2013-08-22 19:34:49

token.0.token = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}
token.0.replacementType = timestamp
token.0.replacement = %Y-%m-%d %H:%M:%S

Example entry:

   "_raw",host,index,source,sourcetype,time
    "{""disk-types"": ""520"", ""max-named-disks-per-request"": ""128"", ""min-aggr-disk-count"": {""min-aggr-disk-count-info"": [{""minimum-disk-count"": ""1"", ""raid-type"": ""raid0""}, {""minimum-disk-count"": ""3"", ""raid-type"": ""raid4""}, {""minimum-disk-count"": ""5"", ""raid-type"": ""raid_dp""}, {""minimum-disk-count"": ""7"", ""raid-type"": ""raid_tec""}]}, ""default-raidtype-config"": {""default-raidtype-config-info"": {""disk-type"": ""FCAL"", ""default-raid-type"": ""raid_dp""}}, ""snapshots-max"": ""255"", ""default-raidtype"": ""raid_dp"", ""checksum-types"": ""block"", ""raidgroup-size"": {""raidgroup-size-info"": [{""maximum-size"": ""14"", ""disktype"": ""FCAL"", ""minimum-size"": ""2"", ""raidtype"": ""raid4"", ""default-size"": ""8""}, {""maximum-size"": ""28"", ""disktype"": ""FCAL"", ""minimum-size"": ""3"", ""raidtype"": ""raid_dp"", ""default-size"": ""16""}, {""maximum-size"": ""29"", ""disktype"": ""FCAL"", ""minimum-size"": ""4"", ""raidtype"": ""raid_tec"", ""default-size"": ""24""}]}, ""node"": ""cluster-9-01"", ""allowed-raidtypes"": {""raidtype-info"": [{""raidtype"": ""raid0""}, {""raidtype"": ""raid4""}, {""raidtype"": ""raid_dp""}, {""raidtype"": ""raid_tec""}]}, ""root-volume"": ""vol0""}","10.0.1.39",ontap,"aggr-get-filer-info","ontap:aggr","2016-12-05 14:53:49"
0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...