topic Re: Sending SNMP to Splunk in Getting Data In

Sending SNMP to Splunk

cqian02 — Tue, 04 Sep 2012 18:10:59 GMT

Still have some doubts about sending SNMP to Splunk

http://docs.splunk.com/Documentation/Splunk/latest/Data/SendSNMPeventstoSplunk

About this step:
Edit C:\usr\etc\snmp\snmptrapd.conf:

snmpTrapdAddr [System IP]:162

authCommunity log [community string]

Is the system IP the one which Splunk is installed on?
I am able to create the log file on the local machine, but it always states:

couldn't open udp:162 -- errno 2 ("No such file or directory")

Are there any other configuration do I need?
Thanks very much.

Re: Sending SNMP to Splunk

MarioM — Wed, 05 Sep 2012 08:15:19 GMT

you can put something like this:

snmpTrapdAddr udp:0.0.0.0:162

authCommunity log,execute,net public

Re: Sending SNMP to Splunk

Damien_Dallimor — Tue, 28 May 2013 21:19:28 GMT

Check out this new add-on : http://splunk-base.splunk.com/apps/88686/snmp-modular-input

Re: Sending SNMP to Splunk

itnetworkteam — Mon, 30 Jan 2017 17:51:10 GMT

So I have SNMPD running, however no SNMP traps are being written tp snmptrapd.log. I have installed wireshark and can see that the traps have arrived on the correct interface with the correct community.

Any ideas?

Thankyou

Re: Sending SNMP to Splunk

cpt12tech — Thu, 20 Apr 2017 01:28:37 GMT

If you're having problems with snmp modular input, may want to give this a try.
https://answers.splunk.com/answers/521362/found-a-simple-snmp-trap-receiver-for-windows-that.html#answer-522171