What version of Splunk can receive traps via SNMPv3?

[splunk_user_btr]

If yes, is there any specific documentation about configuration of Splunk for SNMPv3?

Thanks

[sigma9r]

According to my rep, SNMPv3 is in the works but it's not one of their top priorities.

[dwaddle]

Splunk cannot directly receive SNMP traps for ANY version of SNMP. It does not understand the ASN.1 on-the-wire format and does not have the necessary MIBs to format the trap. Splunk depends on software like snmptrapd to receive the trap off-of-the-wire and then format it into plain text format.

One option for receiving the trap off of the wire is snmptrapd from the NET-SNMP distribution. There is a tutorial on the NET-SNMP site that discusses how to configure it to receive SNMPv3 traps.

Once you have this snmptrapd in place receiving the traps then configuring Splunk to index them should be relatively easy.

[ampledata]

Here's a link to some Splunk Documentation discussing receiving SNMP:

http://docs.splunk.com/Special:SplunkSearch/docs?q=snmp