Splunk MA App for Netcool does not send snmp traps

[wluca]

Hi,

I have configured the SNMP Splunk MA App as described in: https://splunkbase.splunk.com/app/3596/#/details
Geneated a triggered alert that all works fine.
I even can see the triggerd alert in index=_internal source="*/log/splunk/netcool_custom_modular_alert.log"
So the APP seems to be configured correctly. However if no snmp trap has been send to my netcool probe...

I have setup a tcpdump on the server where the trap is send from. It does not capture packets.
the snmpd deamon is running. Any Idea why no traps are send?

thanks

Wichard

[wluca]

SNMP Splunk MA App for Netcool - 3.0 released on april 4th solved our issue with the community string. now in stead of "public" the oid is send which we have set in the SNMP Splunk MA App.

[wluca]

I did use a fake Enterprise OID: 1.2.3.4.5.6.7.8"

When using this fake OID nothing gets sent out, when you change it to a valid OID like 1.3.6.1.2.1.43.18.2.0.1 it starts working.
The only problem I have now is that the community string is send as "public"...although I have configured it not as public in the APP itself

[kkrishnan_splun]

Can you please install wireshark on your receiver host, configure it to capture packets over the wifi or network interface, key in the word "snmp" and see if you're getting any traps ?