I have followed the following links for getting SNMP Data into Splunk:
http://blogs.splunk.com/2013/11/06/adventures-with-snmp-and-cisco-nexus-pt1/
http://blogs.splunk.com/2013/11/06/adventures-with-snmp-and-cisco-nexus-pt2
transforms.conf
[snmp_field_extractions]
REGEX=(.+?)::(.+?)\.\"((?:\d\.?)+)\"\s=\s\"(.*?)\"\s
FORMAT=mib::$1 oid::$2 snmp_index::$3 value::$4
MV_ADD=true
[snmp_keyvalue_extraction]
REGEX=(?:.+?)::(.+?)\.\"(?:(?:\d\.?)+)\"\s=\s\"(.*?)\"\s
FORMAT=$1::$2
[snmp_mib_uid]
REGEX = ([^:]+)::([^\.]+)\.("?)([^"]*)\3 = \"([^\"]*)\"(?= |\n|$)
FORMAT = MIB::$1 UID::$4 Name::$2 $2::$5 Value::$5
props.conf
[snmp_ta]
REPORT-snmpfieldvalues = snmp_field_extractions , snmp_keyvalue_extraction, snmp_mib_uid
DATETIME_CONFIG = NONE
However, I am getting following errors in the splunkd.log:
08-29-2016 21:34:45.689 +0000 WARN DateParserVerbose - A possible timestamp match (Sun Sep 9 01:46:40 2001) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://Nexus 6K Stats|host::67.178.30.20|nexus_snmp|
08-29-2016 21:34:45.689 +0000 WARN DateParserVerbose - A possible timestamp match (Sun Sep 9 01:46:40 2001) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://Nexus 6K Stats|host::67.178.30.20|nexus_snmp|
08-29-2016 21:34:45.689 +0000 WARN DateParserVerbose - A possible timestamp match (Sun Sep 9 01:46:40 2001) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://Nexus 6K Stats|host::67.178.30.20|nexus_snmp|
What could be the issue?
Thanks
↧