Send SNMP Traps

KPSL — Tue, 16 Feb 2021 09:35:41 GMT

We need to send SNMP traps from Splunk to other system.

As per my understanding, these are the steps required:

1. Create custom alert action app

2. Configure alerts from search and add the custom alert action in it.

Is there anything else required to be done?

Is there any sample script to send the snmp traps?

Thanks in advance!!

Re: Send SNMP Traps

gcusello — Tue, 16 Feb 2021 10:33:31 GMT

Hi @KPSL,

there's only a problem: in the fifth field of the Splunk record in alerts, there's the fullpath (on the Splunk server) of the tgz file containing the results of the alert, but the external system receiving the SNMP trap cannot access this file.

So we created a script in perl (we used this language because there's an example in Community) that makes the following steps:

it takes the Alert record,
it opens the tgz file,
it puts the content of the tgz file in the fifth field, sends it in SNMP format to the destination.

In this way the destination server receives also the alert contents.

You can find an example of the script at https://community.splunk.com/t5/Getting-Data-In/Generate-SNMP-trap-from-Splunk/m-p/55732

Ciao.

Giuseppe

topic Send SNMP Traps in Deployment Architecture

Send SNMP Traps

Re: Send SNMP Traps