Deployment Architecture

Send SNMP Traps

KPSL
Observer

We need to send SNMP traps from Splunk to other system.

As per my understanding, these are the steps required:

1. Create custom alert action app

2. Configure alerts from search and add the custom alert action in it. 

Is there anything else required to be done?

Is there any sample script to send the snmp traps? 

 

Thanks in advance!!

Labels (1)
Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @KPSL,

there's only a problem: in the fifth field of the Splunk record in alerts, there's the fullpath (on the Splunk server) of the tgz file containing the results of the alert, but the external system receiving the SNMP trap cannot access this file.

So we created a script in perl (we used this language because there's an example in Community) that makes the following steps:

  • it takes the Alert record,
  • it opens the tgz file,
  • it puts the content of the tgz file in the fifth field, sends it in SNMP format to the destination.

In this way the destination server receives also the alert contents.

You can find an example of the script at https://community.splunk.com/t5/Getting-Data-In/Generate-SNMP-trap-from-Splunk/m-p/55732

Ciao.

Giuseppe

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on