Documentation: 3.3
|  Print Version Contents
This page last updated: 07/10/08 09:07am

Index SNMP events with Splunk

The most effective way to index SNMP events is to use snmptrapd to write them to a FIFO.

First, configure snmptrapd to write to a FIFO rather than to a file on disk.

# mkfifo /var/run/snmp-fifo
# snmptrapd -o /var/run/snmp-fifo

Then, configure the Splunk Server to add the FIFO as a data input.

Note: Splunk running on Windows does not support FIFO queues at this time. Future releases on Windows will support receiving and indexing SNMP traps. Contact support and file an enhancement request if you want to be alerted when this is available.

Previous: Determine what files Splunk is monitoring    |    Next: log4j

Comments

  1. Note that Splunk running on Windows does not support FIFO queues at this time. Future releases on Windows will support receiving and indexing SNMP traps.

    Contact support and file an enhancement request if you want to be alerted when this is available.
    Posted by jcervelli on Jul 09 2008, 4:47pm

Log in to comment.