topic SNMP Modular Input: I created an input stanza to capture traps, but why is the data not getting indexed in Splunk? in All Apps and Add-ons

SNMP Modular Input: I created an input stanza to capture traps, but why is the data not getting indexed in Splunk?

monteirolopes — Tue, 24 May 2016 16:46:15 GMT

Hi,

I created a input stanza using app "SNMP Modular Input" to catch traps (Data Inputs->SNMP->New).

My device is already sending traps to my server (I can see it on wireshark), but the data is not being indexed in Splunk.

Any suggestion? I need to do some extra setup?

Followed this blog that I used as a reference:
http://blogs.splunk.com/2013/06/27/making-snmp-simpler/

Best Regards,
Lopes.

Re: SNMP Modular Input: I created an input stanza to capture traps, but why is the data not getting indexed in Splunk?

Damien_Dallimor — Wed, 25 May 2016 00:04:17 GMT

Post your inputs.conf stanza

Re: SNMP Modular Input: I created an input stanza to capture traps, but why is the data not getting indexed in Splunk?

monteirolopes — Tue, 29 Sep 2020 09:47:14 GMT

Follow my inputs.conf

[snmp://trap]
communitystring = public
do_bulk_get = 0
do_get_subtree = 0
index = networkdevices
ipv6 = 0
snmp_mode = traps
snmp_version = 2C
sourcetype = cisco:trap
split_bulk_output = 0
trap_host = deviceip
trap_port = 162
trap_rdns = 0
v3_authProtocol = usmHMACMD5AuthProtocol
v3_privProtocol = usmDESPrivProtocol

Re: SNMP Modular Input: I created an input stanza to capture traps, but why is the data not getting indexed in Splunk?

Damien_Dallimor — Mon, 30 May 2016 10:51:54 GMT

Try setting your trap_host to the fully qualified domain name that the trap is being sent to , or IP address etc...

Re: SNMP Modular Input: I created an input stanza to capture traps, but why is the data not getting indexed in Splunk?

monteirolopes — Mon, 30 May 2016 13:14:52 GMT

I set the field trap_host with the hostname+domain and / or IP address and still didn't work .
Another suggestion?

Re: SNMP Modular Input: I created an input stanza to capture traps, but why is the data not getting indexed in Splunk?

monteirolopes — Tue, 31 May 2016 13:51:23 GMT

Damien Dallimore,

My problem was that I had a SNMP service running on the Splunk server and it was already bound to the 162 port.
Now my inputs are working.

Thank you!

Best regard,
Lopes.

Re: SNMP Modular Input: I created an input stanza to capture traps, but why is the data not getting indexed in Splunk?

Hemnaath — Wed, 06 Dec 2017 17:26:10 GMT

Hi monteirolopes, hey we got a request from a client to configure an Cisco Prime SNMP Trap Monitoring in splunk. To start with I need to create an Inputstanza which has the index=network sourcetype=cisco:network:primesnmp.

Could please guide me how to setup a monitoring for capturing the SNMP trap in splunk.

thanks in advance.