Using Splunk 6.2.1 and latest snmp_ta (1.2.7) SNMP data collection stops working randomly and shows the error below in splunkd.log (for each of the stanzas configured) 02-25-2015 11:04:24.837 -0800 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" unknownEngineID snmp_stanza:snmp://xxxx It can be easily reproduced by stopping the snmp daemon that it is querying for a few minutes and starting it again. The easiest way I found to get it back up is to do a /en-US/debug/refresh . Then errors stop and SNMP data collection works again. Using the following stanza in inputs.conf: [snmp://XXX] communitystring = xxxx destination = xxxx do_bulk_get = 1 ipv6 = 0 max_repetitions = 25 mib_names = xxx (custom MIB) non_repeaters = 0 object_names = 1.3.6.1.4.1.7102.1971 snmp_mode = attributes snmp_version = 3 sourcetype = xxxxx_snmp_ta split_bulk_output = 1 v3_authProtocol = usmHMACMD5AuthProtocol v3_privKey = v3_privProtocol = usmDESPrivProtocol v3_securityName = xxxxx v3_authKey = xxxxx snmpinterval = 300 It is gathering data from Linux Snmpd (net-snmp)with a custom MIB provided by a 3rd party vendor. Anyone had the same issue? any idea on how to resolve this? Thanks ... View more

Could someone please document how the Splunk passwords are encrypted (in inputs and outputs.conf) so that we can setup our configuration management tools (Chef, Puppet etc...) to properly encrypt the passwords in the conf files without provisioning clear password and restarting Splunk a each chef run? Just a shell, perl, python or other example using the etc/auth/splunk.secret would help a LOT we figured out how dbconnect does (even had to fix a bug when passwords contains a "=") - can't find any details on the $1$xxxxxxxxxx passwords used in inputs.conf and outputs.conf Thanks!! ... View more

Hi Everyone Problem: On Splunk App for Unix (latest versions of all the components) on a search head I cannot see hosts from indexers peered to the search head. The data is there if I do a search on index=os ( I can see perf data for all the hosts: CPU, PS etc...), but in the dashboard I can only see the hosts indexed locally (local host and a forwarder). What am I doing wrong? Example: = splunk-search (local indexer and search-head) peered with splunk-indexer === splunk-forwarder X (forwarding to splunk-search) === splunk-forwarder Y (forwarding to splunk-search) =splunk-indexer (local indexer) === splunk-forwarder A (forwarding to splunk-indexer) === splunk-forwarder B (forwarding to splunk-indexer) === splunk-forwarder C (forwarding to splunk-indexer) If I go to Splunk App for Unix dashboard on splunk-indexer I can see hosts for: splunk-indexer (local) + splunk-forwarder A, B, C (which is expected) If I go to Splunk App for Unix dashboard on splunk-search I can only see hosts for: splunk-search (local) + splunk-forwarder X,Y - NOT splunk-indexer, nor splunk-forwarder A, B and C But when I do a search on splunk-search index=os I can see data being found for all hosts. Do I need to setup Splunk App for Unix in a specific way to display data for remote/peered indexes? ... View more