This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6
The most effective way to index SNMP events is to use snmptrapd to write them to a FIFO.
First, configure snmptrapd to write to a FIFO rather than to a file on disk.
# mkfifo /var/run/snmp-fifo # snmptrapd -o /var/run/snmp-fifo
Then, configure the Splunk Server to add the FIFO as a data input.