Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Dynamic Host Field Value for SNMP Traps
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have my traps set up to go to a log file in /var/log/snmp-traps. I want to be able to have the host field value reflect the actual host the trap originally came from. Is that possible? See trap below, host portion is bold.
NET-SNMP version 5.4.2.1
2012-09-25 17:41:17 testhost.host.net 192.168.15.15 TRAP, SNMP v1, community c@nT0uchth1S
CISCO-CONFIG-MAN-MIB::ciscoConfigManMIBNotificationPrefix Enterprise Specific Trap (CISCO-CONFIG-MAN-MIB::ciscoConfigManEvent) Uptime: 83 days, 15:48:11.04
CISCO-CONFIG-MAN-MIB::ccmHistoryEventCommandSource.1004 = INTEGER: commandLine(1) CISCO-CONFIG-MAN-MIB::ccmHistoryEventConfigSource.1004 = INTEGER: commandSource(2) CISCO-CONFIG-MAN-MIB::ccmHistoryEventConfigDestination.1004 = INTEGER: running(3)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sure! On the indexer, set up props.conf / transforms.conf settings that extract the value you want for host and then write it to the host field:
props.conf
[yoursourcetype]
TRANSFORMS-snmphost = snmphost
transforms.conf
[snmphost]
REGEX = ^NET-SNMP version [\d\.]+\s+\d{4}-\d{2}-\d[2} \d+:\d+:\d: (\S+)
FORMAT = host::$1
DEST_KEY = MetaData:Host
(make sure the regex matches correctly using something like Splunk's own rex/regex commands or external tools like regexpal.net)
This is covered in the docs as well: http://docs.splunk.com/Documentation/Splunk/latest/Data/overridedefaulthostassignments#transforms.co...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Works perfectly! thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sure! On the indexer, set up props.conf / transforms.conf settings that extract the value you want for host and then write it to the host field:
props.conf
[yoursourcetype]
TRANSFORMS-snmphost = snmphost
transforms.conf
[snmphost]
REGEX = ^NET-SNMP version [\d\.]+\s+\d{4}-\d{2}-\d[2} \d+:\d+:\d: (\S+)
FORMAT = host::$1
DEST_KEY = MetaData:Host
(make sure the regex matches correctly using something like Splunk's own rex/regex commands or external tools like regexpal.net)
This is covered in the docs as well: http://docs.splunk.com/Documentation/Splunk/latest/Data/overridedefaulthostassignments#transforms.co...
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Automating Threat Operations and Threat Hunting with Recorded Future
Keep the Learning Going with the New Best of .conf Hub
Splunk Community Badges!
