Documentation > Splunk > Admin Manual > Send SNMP events to Splunk

Admin Manual

 


Welcome
What to do first
Start Splunk
Meet Splunk Web and Splunk Apps
Before you configure
Add data and configure inputs
Indexing and event processing
Timestamps
Add and manage users
Manage indexes
Define alerts
Set up backups and retention policies
Configure data security
Set up forwarding and receiving
Deploy to other Splunk instances
Set up distributed search
Manage search jobs
Use Splunk's command line interface (CLI)
Configuration file reference
Troubleshooting

Send SNMP events to Splunk

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

Send SNMP events to Splunk

This topic covers ways to send SNMP events to your Splunk indexer.

On UNIX

The most effective way to index SNMP events is to use snmptrapd to write them to a file.

First, configure snmptrapd to write to a file on disk. 

# touch /var/run/snmp-traps
# snmptrapd -Lf /var/run/snmp-traps

Then, configure the Splunk server to add the file as an input.

On Windows

To index SNMP traps on Splunk for Windows:

1. Install NET-SNMP from http://www.net-snmp.org/

2. Register snmptrapd as service using the script included in install.

3. Edit C:\usr\etc\snmp\snmptrapd.conf 

snmpTrapdAddr [System IP]:162
authCommunity log [community string]

4. Add a stanza to inputs.conf for snmptrapd.log: 

[monitor://C:\usr\log\snmptrapd.log]
disabled = false
host = [hostname]
index = default
sourcetype = snmptrap
alwaysOpenFile = 1

Make sure you make your edits in a copy of inputs.conf in $SPLUNK_HOME/etc/system/local, DO NOT EDIT THE COPY IN $SPLUNK_HOME/etc/system/default. For information about how Splunk uses configuration files, read "About configuration files" in this manual.

5. Specify alwaysOpenFile = 1 or you won’t index new events.

6. Point your SNMP traps at the trapd host.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.0.3/Admin/SendSNMPeventstoSplunk"

This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.