How can I make my SNMP traps appear as from individual hosts?

[benzieb]

I've just configured my first Splunk server (ubuntu 11.04) with snmptrapd logging to /var/log/snmp-traps as per http://docs.splunk.com/Documentation/Splunk/latest/Data/SendSNMPeventstoSplunk - this works well, but all SNMP messages then appear in Splunk as coming from one host (ie, the Splunk server).

How can I make Splunk receive traps and display their correct source host? (is this possible?)

TIA!

[mschmttco]

The best way I have found to get snmp data into Splunk is to use NerveCenter as the initial trap receiver and polling engine. NerveCenter can receive the trap then parse it if desired and pass the massaged/reformatted data to Splunk (ie calling out the original host the trap can from (even thru natting). NerveCenter can also decode the trap and add more meaningful descriptions to the raw trap before passing it to Splunk. For polling snmp data NerveCenter will also be able to format or apply calculations on the fly (ie log not just if counter data but the deltas or the calculated % bandwidth usage) See www.logmatrix.com or post more specific questions to http://www.linkedin.com/groups?home=&gid=1149677&trk=anet_ug_hm

[jlixfeld]

Ditto! Anyone have a solution for this?