Documentation: 3.2
|  Print Version Contents
This page last updated: 03/02/08 03:03pm

Index SNMP events with Splunk

The most effective way to index SNMP events is to use snmptrapd to write them to a FIFO.

First, configure snmptrapd to write to a FIFO rather than to a file on disk.

# mkfifo /var/run/snmp-fifo
# snmptrapd -o /var/run/snmp-fifo

Then, configure the Splunk Server to add the FIFO as a data input.

Previous: Determine what files Splunk is tailing    |    Next: log4j

Comments

  1. Update, I just ran this and -o FILE is deprecated. New command for stage two is:
    # snmptrapd -Lf /var/run/snmp-fifo
    Posted by zestuart on May 22 2008, 8:26am

  2. Unless Splunk had a built-in way of catching SNMP, then yes, it seems like this is the best way. How else would you suggest catching SNMP events?
    Posted by emma on Apr 04 2008, 4:44pm

  3. Just curious - is this necessary (going through snmptrapd) only because snmp is sent as binary across the network?
    Posted by goldburtd on Mar 23 2008, 12:24pm

Log in to comment.