Hi
This output you get in splunk is the result of processing snmp traps by DefaultResponseHandler in responsehandlers.py. It does not process traps properly, especially can't handle OID value to produce human readable appearance.
Below is my hustom responsehadler which gives slightly better results in splunk.
class TRAP_ONLY_HANDLER:
def __init__(self,**args):
pass
def __call__(self, response_object,destination,table=False,from_trap=False,trap_metadata=None,split_bulk_output=False,mibView=None):
splunkevent =""
#handle traps
if from_trap:
for oid, val in response_object:
try:
(symName, modName), indices = mibvar.oidToMibName(mibView, oid)
splunkevent +='%s::%s.%s' % (modName, symName,'.'.join([ v.prettyPrint() for v in indices]))
except: # catch *all* exceptions
e = sys.exc_info()[1]
logging.error("Exception resolving MIB name in the caught trap: %s" % str(e))
splunkevent +='%s = ' % (oid)
# Changed part
try:
str_val = val.prettyPrint()
# Get value format (group1) and value (group2)
val_matches = re.search(r'_.+:\s+.+:\s+.+:\s+(.+)=(.+)',str_val)
# valName (format) probably should be vanished
valName = val_matches.group(1)
valVal = val_matches.group(2)
splunkevent +='(%s) = "%s" ' % (valName, valVal)
except:
splunkevent +='[still not working] val=[%s] ' % (val.prettyPrint())
splunkevent = trap_metadata + splunkevent
print_xml_single_instance_mode(destination, splunkevent)
You should have good knowledge of pysnmp to write proper responsehandler. I hope developers will make one someday.
... View more
