Following the instruction from here, Send SNMP events to your Splunk deployment I'm setting up the monitoring of the file al /var/log/snmp-traps. I wonder what would be the source type. I guess that there should be one defined already.
It has the following content: for example,
NET-SNMP version 5.7.3
2020-06-22 16:30:44 localhost [UDP: [127.0.0.1]:49799->[127.0.0.1]:162]:
iso.3.6.1.2.1.1.3.0 = Timeticks: (1) 0:00:00.01 iso.3.6.1.6.3.1.1.4.1.0 = OID: ccitt.1
2020-06-22 16:50:44 localhost [UDP: [127.0.0.1]:59061->[127.0.0.1]:162]:
iso.3.6.1.2.1.1.3.0 = Timeticks: (1) 0:00:00.01 iso.3.6.1.6.3.1.1.4.1.0 = OID: ccitt.1
2020-06-22 16:50:48 localhost [UDP: [127.0.0.1]:59062->[127.0.0.1]:162]:
iso.3.6.1.2.1.1.3.0 = Timeticks: (1) 0:00:00.01 iso.3.6.1.6.3.1.1.4.1.0 = OID: ccitt.1
2020-06-22 17:21:36 localhost [UDP: [127.0.0.1]:58259->[127.0.0.1]:162]:
iso.3.6.1.2.1.1.3.0 = Timeticks: (1) 0:00:00.01 iso.3.6.1.6.3.1.1.4.1.0 = OID: ccitt.1
Thanks for your help!
