This warning has been polluting my internal logs for a long time:
11-27-2019 13:39:46.280 +0000 WARN IndexedCSV - csv file /opt/splunk/var/run/searchpeers/B5C95237-71AF-4203-AD5C-F88B10308CFC-1574861980/apps/cisco_ios/lookups/cisco_ios_messages.csv has 2 missing fields
Today I finally decided to look at it. Using some filtering in Excel, I found two lines in the **cisco_ios_messages.csv** lookup file in this app that didn't have all the columns populated:
splunk@splunk:[~/etc/shcluster/apps/cisco_ios/lookups]> grep '""' cisco_ios_messages.csv
"ZONE","6","ZS_INVALID_MEMBER","Invalid member [dec] [chars]","Invalid member type [dec] [chars] recieved from the API call.",""
"ZONE","6","ZS_UNKNOWN_LIC_FEATURE","[chars]","",""
A bit of googling uncovered this Cisco page [Cisco MDS 9000 Family and Nexus 7000 Series NX-OS System Messages Reference][1]. With the information from that page, I fixed the lookup file. Now the internal errors are gone:
"ZONE","6","ZS_INVALID_MEMBER","Invalid member [dec] [chars]","Invalid member type [dec] [chars] recieved from the API call.","No action is required."
"ZONE","6","ZS_UNKNOWN_LIC_FEATURE","[chars]","Zone Server received an event for an known licensing feature: [chars].","No action is required."
[1]: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/system_messages/reference/sys_Book/sl_7K_MDS_u_to_z.html
Thank you for the app!
↧