Send SNMP Traps

[KPSL]

We need to send SNMP traps from Splunk to other system.

As per my understanding, these are the steps required:

1. Create custom alert action app

2. Configure alerts from search and add the custom alert action in it. 

Is there anything else required to be done?

Is there any sample script to send the snmp traps? 

Thanks in advance!!

[gcusello]

Hi @KPSL,

there's only a problem: in the fifth field of the Splunk record in alerts, there's the fullpath (on the Splunk server) of the tgz file containing the results of the alert, but the external system receiving the SNMP trap cannot access this file.

So we created a script in perl (we used this language because there's an example in Community) that makes the following steps:

• it takes the Alert record,
• it opens the tgz file,
• it puts the content of the tgz file in the fifth field, sends it in SNMP format to the destination.

In this way the destination server receives also the alert contents.

You can find an example of the script at https://community.splunk.com/t5/Getting-Data-In/Generate-SNMP-trap-from-Splunk/m-p/55732

Ciao.

Giuseppe