This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 2.1 , 2.2 , 2.2.1 , 2.2.3 , 2.2.6
The most effective way to index SNMP events is to use snmptrapd to write them to a FIFO.
First, configure snmptrapd to write to a FIFO rather than to a file on disk.
# mkfifo /var/run/snmp-fifo # snmptrapd -o /var/run/snmp-fifo
Then, configure the Splunk Server to add the FIFO as a data input.