Getting Data In

Splunk sendsnmp.cmd not working properly

mship
Path Finder

I am using the following script in /bin/scripts on splunk to send snmp traps from my windows server to my NMS and it is not working with no errors. I am troublshooting by running it from the command prompt and what I am noticing is that it is running each set and command as a separate command in windows vice as one unified script. Below is the script from the windows wiki this is exactly what I am using except I put in correct IP's etc...

setlocal

set SNMPAGENTHOST=127.0.0.1
set SNMPAGENTPORT=162
set TRAPOID=1.3.6.1.4.1.27389.1.2
set OID=1.3.6.1.4.1.27389.1.1
set SNMPCOMMUNITY=public
set SNMPTRAPCMD=C:\usr\bin\snmptrap.exe
for /f "usebackq" %%h in (hostname) do @set myhost=%%h
set num=%~1
set num=%num:'=%
set terms=%2
set query=%3
set sname=%4
set reason=%5
set permalink=%6
if "%8" == "" (
set resultspath=%7
) else (
set tags=%7
set resultspath=%8
)

if "%8" == "" (
"%SNMPTRAPCMD%" -v 2c -c %SNMPCOMMUNITY% %SNMPAGENTHOST%:%SNMPAGENTPORT% "" %TRAPOID% %OID%.1 i %num% %OID%.2 s %terms% %OID%.3 s %query% %OID%.4 s %sname% %OID%.5 s %reason% %OID%.6 s %permalink% %OID%.8 s %resultspath%
) ELSE (
"%SNMPTRAPCMD%" -v 2c -c %SNMPCOMMUNITY% %SNMPAGENTHOST%:%SNMPAGENTPORT% "" %TRAPOID% %OID%.1 i %num% %OID%.2 s %terms% %OID%.3 s %query% %OID%.4 s %sname% %OID%.5 s %reason% %OID%.6 s %permalink% %OID%.8 s %resultspath% %OID%.7 s %tags%
)

endlocal

Tags (1)
0 Karma

mship
Path Finder

Well seems you have to use NET-SNMP. I was trying to get it to work using C:\Windows\System32\snmptrap.exe Installed and configured NET-SNMP and now traps are going out.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...