Getting Data In

Create cleaner snmptrapd logs

_joe
Contributor

Hello All,

I was wondering if there is a way to cleanup the key value pair logging inside of snmptrapd? I am ingesting these logs with a UF and I do not want to perform rex sed from my indexers. Thanks.

Here is my current format string

vi /etc/snmp/snmptrapd.conf
format2 Date = %y-%02.2m-%02.2l %02.2h:%02.2j:%02.2k\n%V\n%v\n---\n

My logs look like this:
CISCO-LWAPP-DOT11-CLIENT-MIB::cldcApMacAddress.'....6C' = mac-address
CISCO-LWAPP-DOT11-CLIENT-MIB::cldcClientByIpAddressType.0 = ipv4
CISCO-LWAPP-DOT11-CLIENT-MIB::cldcClientUsername.'@&....' = name
CISCO-LWAPP-DOT11-CLIENT-MIB::cldcClientSSID.'@&....' = Employee
CISCO-LWAPP-DOT11-CLIENT-MIB::cldcClientSessionID.'@&....' = id
CISCO-LWAPP-DOT11-CLIENT-MIB::cldcApMacAddress.'@&....' = mac

I would like them to look like this (before ingesting them into Splunk)
cldcApMacAddress = mac-address
cldcClientByIpAddressType = ipv4

If that isn't possible, I would at least like to remove the random characters (example: "@&...." and "'....6C'"). I am not sure why they are generating.

0 Karma

bgraabek_splunk
Splunk Employee
Splunk Employee

Perform the cleanup in, say, a looping script that writes the cleaned up events to a separate log file and then have the UF pick up events from that log file?

0 Karma

_joe
Contributor

I appreciate the feedback. At that point, I will just use rex mode=sed though. I would like to know if it would be possible to do this in snmptrapd since, I am assuming, that would be most efficient.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...