Getting Data In

SNMP info from device to splunk

flanny22
New Member

We have a device setup to send out SNMP information to splunk, which is a useid from AD and their client IP address. Is possible to use a script within Splunk that can parse our that relevant information and send it to another device?

thank you

Tags (1)
0 Karma

piebob
Motivator

yes, you can forward a subset of your data to a third-party system. information is here:

http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Forwarddatatothird-partysystemsd

flanny22
New Member

yes i did that. I am now setting up Splunk on a Debian box. Windows drives me crazy...
thank you for your input.

0 Karma

Ayn
Legend

For net-snmp support your best shot is to post questions on a net-snmp forum/mailing list or similar.

flanny22
New Member

one other thing, windows services snmp and snmptrap are installed but disabled.

tia

0 Karma

flanny22
New Member

In my c:\usr\etc\snmp\snmp.conf file i have the following
mibdirs C:/usr/share/snmp/mibs
persistentDir C:/usr/snmp/persist
tempFilePattern C:/usr/temp/snmpdXXXXXX
snmpTrapdAddr 10.4.0.7:162
authCommunity log public

thank you for you feedback

0 Karma

flanny22
New Member

thank you. So net-snmp and splunk are on the same box, windows 2003. when I run the command "snmptranslate -IR -Td IF-MIB::linkDown" I get the following
C:\usr\perl>snmptranslate -IR -Td IF-MIB::linkDown
No log handling enabled - using stderr logging
C:/usr/etc/snmp/snmp.conf: line 4: Warning: Unknown token: snmpTrapdAddr.
C:/usr/etc/snmp/snmp.conf: line 5: Warning: Unknown token: authCommunity.
IF-MIB::linkDown

0 Karma

Ayn
Legend

No, what you should do is setup net-snmp and have it listen to port 162, then have Splunk read the files that net-snmp writes to.

flanny22
New Member

OK, so getting our device to send snmp to splunk has been a little challenge.
On a windows box with splunk installed, do I setup a receiver on port 162 for SNMP to access the snmp infor from our device?
I have net-snmp installed as per another post on here.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.