Can I extract Syslog from SNMP traps using SNMP Modular Input via UDP (or TCP) 514?

[Splunker]

Hi folks,

I'll try this out shortly, but thought i'd ask.

Cisco devices have the ability to send standard RFC formatted Syslogs over SNMP (v3 in this case) traps over TCP.

Using the SNMP Modular input, could i extract the Syslog from the trap and process it as if it was a normal Syslog entering Splunk via UDP (or TCP) 514?

I've ingested traps via snmptrapd writing to a log-file in the past, but there is alot of SNMP "junk" in the log i'd have to filter out, i was wondering if the SNMP modular input app has the same issue?

If anyone has any experience, comments, etc, in such a configuration?

Thanks.

[Damien_Dallimor]

1) The SNMP Modular Input trap listener only listens on UDP (not TCP).

2) if you send syslog formatted data inside the trap , this will get indexed in Splunk and you can then perform whatever search time extractions you require to pull the relevant data from the syslog string into the fields you are interested in and ignore all the junk.