Getting Data In

SNMP Modular Input trap issue

clymbouris
Path Finder

Hi,

I'm trying to setup Splunk as a trap listener via the Modular Input for some testing.

My inputs.conf looks like this:

[snmp://saa_traps]

communitystring = public

do_bulk_get = 0

ipv6 = 0

snmp_mode = traps

snmp_version = 1

sourcetype = saa_traps

split_bulk_output = 0

trap_host = localhost

trap_port = 162

v3_authProtocol = usmHMACMD5AuthProtocol

v3_privProtocol = usmDESPrivProtocol

I can see the packet coming in through Wireshark but it doesn't get indexed. The splunkd.log doesn't indicate any issues.

Not sure if related but once I get the SNMP packet from my monitored system my Splunk server sends back an ICMP reply: Destination Unreachable/Port Unreachable

Any ideas?

Lots of thanks

Tags (3)
0 Karma

starcher
Influencer

Just taking a stab at it. But you specified the snmp_host as local host. That probably is binding it to the localhost interface instead of the IP address your trap generating hosts are sending to. If your network address for the Splunk server is say 192.168.1.10, try changing it to snmp_host=192.168.1.10 instead. Not sure if you need to restart Splunk but probably.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...