Getting Data In

Splunk sendsnmp.cmd not working properly

mship
Path Finder

I am using the following script in /bin/scripts on splunk to send snmp traps from my windows server to my NMS and it is not working with no errors. I am troublshooting by running it from the command prompt and what I am noticing is that it is running each set and command as a separate command in windows vice as one unified script. Below is the script from the windows wiki this is exactly what I am using except I put in correct IP's etc...

setlocal

set SNMPAGENTHOST=127.0.0.1
set SNMPAGENTPORT=162
set TRAPOID=1.3.6.1.4.1.27389.1.2
set OID=1.3.6.1.4.1.27389.1.1
set SNMPCOMMUNITY=public
set SNMPTRAPCMD=C:\usr\bin\snmptrap.exe
for /f "usebackq" %%h in (hostname) do @set myhost=%%h
set num=%~1
set num=%num:'=%
set terms=%2
set query=%3
set sname=%4
set reason=%5
set permalink=%6
if "%8" == "" (
set resultspath=%7
) else (
set tags=%7
set resultspath=%8
)

if "%8" == "" (
"%SNMPTRAPCMD%" -v 2c -c %SNMPCOMMUNITY% %SNMPAGENTHOST%:%SNMPAGENTPORT% "" %TRAPOID% %OID%.1 i %num% %OID%.2 s %terms% %OID%.3 s %query% %OID%.4 s %sname% %OID%.5 s %reason% %OID%.6 s %permalink% %OID%.8 s %resultspath%
) ELSE (
"%SNMPTRAPCMD%" -v 2c -c %SNMPCOMMUNITY% %SNMPAGENTHOST%:%SNMPAGENTPORT% "" %TRAPOID% %OID%.1 i %num% %OID%.2 s %terms% %OID%.3 s %query% %OID%.4 s %sname% %OID%.5 s %reason% %OID%.6 s %permalink% %OID%.8 s %resultspath% %OID%.7 s %tags%
)

endlocal

Tags (1)
0 Karma

mship
Path Finder

Well seems you have to use NET-SNMP. I was trying to get it to work using C:\Windows\System32\snmptrap.exe Installed and configured NET-SNMP and now traps are going out.

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...