All Apps and Add-ons

SNMP Modular Input not working. Error with snmp.py

johnyonemoto8
Explorer

What are causing these errors?
04-24-2015 21:21:48.936 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" Traceback (most recent call last):
04-24-2015 21:21:48.937 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" File "/opt/splunk/etc/apps/snmp_ta/bin/snmp.py", line 771, in
04-24-2015 21:21:48.937 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" do_run()
04-24-2015 21:21:48.937 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" File "/opt/splunk/etc/apps/snmp_ta/bin/snmp.py", line 475, in do_run
04-24-2015 21:21:48.937 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" mibBuilder.loadModules(*mib_names_args)
04-24-2015 21:21:48.937 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" File "/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 259, in loadModules
04-24-2015 21:21:48.937 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" pysnmp.smi.error.SmiError: MIB module "/opt/splunk/etc/apps/snmp_ta/bin/mibs/Rx8000-AUDIO.mib.py" load error: ['Traceback (most recent call last):\n', ' File "/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 255, in loadModules\n exec(modData, g)\n', ' File "", line 7, in \n', ' File "/opt/splunk/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 294, in importSymbols\n \'importSymbols: empty MIB module name\'\n', 'SmiError: importSymbols: empty MIB module name\n']

[snmp://test]
destination = 
do_bulk_get = 0
do_get_subtree = 0
ipv6 = 0
mib_names = Rx8000-AUDIO.mib, Rx8000_base.mib, RX8000-BASE.mib,Rx8000-VIDEO.mib
object_names = 1.3.6.1.4.1.1773.1.3.208.3.3.3.0, 1.3.6.1.4.1.1773.1.3.208.3.4.3.1.2.1, 1.3.6.1.4.1.1773.1.3.208.3.4.3.1.2.2, 1.3.6.1.4.1.1773.1.3.208.3.4.3.1.2.3, 1.3.6.1.4.1.1773.1.3.208.3.4.3.1.2.4, 1.3.6.1.4.1773.1.3.208.3.3.9.0
response_handler_args =
snmp_mode = attributes
snmp_version = 2C
sourcetype = snmp
split_bulk_output = 0
trap_rdns = 0
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol
Tags (1)

Damien_Dallimor
Ultra Champion
mib_names = Rx8000-AUDIO.mib, Rx8000_base.mib, RX8000-BASE.mib,Rx8000-VIDEO.mib

Have you converted your MIBs to python modules correctly (as per the docs) ?

johnyonemoto8
Explorer

Yes. Converted MIBs to python modules as per your instructions, (Rx8000-AUDIO.mib.py, Rx8000_base.mib.py, RX8000-BASE.mib.py and Rx8000-VIDEO.mib.py) placed in SPLUNK_HOME/etc/apps/snmp_ta/bin/mibs directory

0 Karma

Damien_Dallimor
Ultra Champion

If your raw mib is named Rx8000-AUDIO.mib , then this should be output to Rx8000-AUDIO.py, placed in SPLUNK_HOME/etc/apps/snmp_ta/bin/mibs , and then in the config be specified as Rx8000-AUDIO

Try that.

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

you probably want to show your input stanza... it will be in inputs.conf and start something like this:
[snmp://nameofyourinput]

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

johnyonemoto8
Explorer

[snmp://test]
destination =
do_bulk_get = 0
do_get_subtree = 0
ipv6 = 0
mib_names = Rx8000-AUDIO.mib, Rx8000_base.mib, RX8000-BASE.mib,Rx8000-VIDEO.mib
object_names = 1.3.6.1.4.1.1773.1.3.208.3.3.3.0, 1.3.6.1.4.1.1773.1.3.208.3.4.3.1.2.1, 1.3.6.1.4.1.1773.1.3.208.3.4.3.1.2.2, 1.3.6.1.4.1.1773.1.3.208.3.4.3.1.2.3, 1.3.6.1.4.1.1773.1.3.208.3.4.3.1.2.4, 1.3.6.1.4.1773.1.3.208.3.3.9.0
response_handler_args =
snmp_mode = attributes
snmp_version = 2C
sourcetype = snmp
split_bulk_output = 0
trap_rdns = 0
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...