
Send SNMP traps to other systems
You can use Splunk as a monitoring tool to send SNMP alerts to other systems such as a Network Management System console.
Note: For information on how to index SNMP alerts on Splunk, read Send SNMP events to Splunk in the Getting Data In manual.
Create a script that sends the SNMP traps
Requirements
Requirements for the example script:
- Perl is required to run the script.
- Net-SNMP package is required in order to use the
/usr/bin/snmptrap
command. If you have another way of sending an SNMP trap from a shell script, modify the script as needed. - Make sure there's admin access to the
$SPLUNK_HOME/bin/scripts
directory. - For security reasons, scripts must reside in the
$SPLUNK_HOME/bin/scripts
directory.
Example script to send SNMP traps to other systems
Note the following:
- Create the script in the
$SPLUNK_HOME/bin/scripts
directory. Create the directory if it doesn't already exist. Copy the code listed below intosendsnmptrap.pl
.
- Run
chmod +x sendsnmptrap.pl
to make the script executable.
- In the scrpt, change the
Host:Port
of the SNMP trap handler, the paths to the external commandssplunk
andsnmptrap
, and the user/password if necessary.
Sample script code
#!/usr/bin/perl # # sendsnmptrap.pl: A script to enable using Splunk alerts to send an SNMP trap. # # Modify the following code as necessary for your local environment. # $hostPortSNMP = "qa-tm1:162"; # Host:Port of snmpd or other SNMP trap handler $snmpTrapCmd = "/usr/bin/snmptrap"; # Path to snmptrap, from http://www.net-snmp.org $TRAPOID = "1.3.6.1.4.1.27389.1.2"; # Object IDentifier for traps/notifications $OID = "1.3.6.1.4.1.27389.1.1"; # Object IDentifier for objects, Splunk Enterprise OID is 27389 # Parameters passed in from the alert. # $1-$9 is the positional parameter list. $ARGV[0] starts at $1 in Perl. $searchCount = $ARGV[0]; # $1 - Number of events returned $searchTerms = $ARGV[1]; # $2 - Search terms $searchQuery = $ARGV[2]; # $3 - Fully qualified query string $searchName = $ARGV[3]; # $4 - Name of saved search $searchReason = $ARGV[4]; # $5 - Reason saved search triggered $searchURL = $ARGV[5]; # $6 - URL/Permalink of saved search $searchTags = $ARGV[6]; # $7 - Always empty as of 4.1 $searchPath = $ARGV[7]; # $8 - Path to raw saved results in Splunk instance (advanced) # Send trap, with the parameter list above mapping down into the OID. $cmd = qq/$snmpTrapCmd -v 2c -c public $hostPortSNMP '' $TRAPOID $OID.1 i $searchCount $OID.2 s "$searchTerms" $OID.3 s "$searchQuery" $OID.4 s "$searchName" $OID.5 s "$searchReason" $OID.6 s "$searchURL" $OID.7 s "$searchTags" $OID.8 s "$searchPath"/; system($cmd);
For Windows
This Perl script will work on MS Windows systems with Perl. However, on some Windows systems, Perl may not be installed, or Perl scripts may not be configured to be directly executable via Splunk. In those cases, you might find it easier to use a Windows CMD script, as described in the Splunk community wiki topic Sending SNMP traps on Windows.
Provide an MIB file
You can provide a Splunk MIB file for the SNMP monitoring agent. See the Splunk community wiki topic Splunk Alert MIB for details.
Configure your alert to call the script
Follow these steps:
1. Create an alert. Read About alerts in the Alerting Manual for more information.
2. Set up your alert so that it calls the script. To do so, specify the name of the script (which must reside in $SPLUNK_HOME/bin/scripts
).
Example script run
Here is an example of the script running, including what it returns:
[root@qa-tm1 ~]# snmptrapd -f -Lo 2007-08-13 16:13:07 NET-SNMP version 5.2.1.2 Started. 2007-08-13 16:14:03 qa-el4.splunk.com [172.16.0.121] (via UDP: [172.16.0.121]:32883) TRAP, SNMP v1, community public SNMPv2-SMI::enterprises.27389.1 Warm Start Trap (0) Uptime: 96 days, 20:45:08.35 SNMPv2-SMI::enterprises.27389.1.1 = INTEGER: 7 SNMPv2- SMI::enterprises.27389.1.2 = STRING: "sourcetype::syslog" SNMPv2- SMI::enterprises.27389.1.3 = STRING: "search sourcetype::syslog starttime:12/31 /1969:16:00:00 endtime::08/13/2007:16:14:01" SNMPv2-SMI::enterprises.27389.1.4 = STRING: "SyslogEventsLast24" SNMPv2-SMI::enterprises.27389.1.5 = STRING: "Saved Search [SyslogEventsLast24]: The number of hosts(7) was greater than 1" SNMPv2-SMI::enterprises.27389.1.6 = STRING: "http://qa-el4:18000/?q=sourcetype %3a%3asyslog%20starttimeu%3a%3a0%20endtimeu%3a%3a1187046841" SNMPv2- SMI::enterprises.27389.1.7 = STRING: "/home/tet/inst/splunk/var/run/splunk /SyslogEventsLast24" 2007-08-13 16:14:15 NET-SNMP version 5.2.1.2 Stopped.
PREVIOUS Configure alerts in savedsearches.conf |
NEXT Configure a script for an alert action |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14
Feedback submitted, thanks!