Splunk Dev

How to export snmp trap to other file (eg. txt file)or clear the snmptrapd.log

sony_1688
New Member

My situation is: I have installed the Net-snmp and I have configured this to receive trap to the snmptrapd.log and I also have installed the splunk and have configured the those script in input.conf file

[monitor://c:\usr\log\snmptrapd.log]
disabled = false
host = snmplog
index = default
sourcetype = snmptrap
alwaysOpenFile = 1

Finally, I also can get the log in the splunk. (1) Now, I have a question that I want to record\export the log from the index or from the raw data to other txt file or some file that I can available to see the log periodically in splunk. Does Splunk provide this function? or how? (2) I also want to clear the snmptrapd.log periodically in splunk or other method because I think when the there are large amount log in snmptrapd,and I also can not delete the script in snmptrapd.log unless stop the snmp service. when the snmptrapd.log can not receive more data, I don't know want will happen. Does splunk can handle this problem?

Tags (1)
0 Karma

bwooden
Splunk Employee
Splunk Employee

Have you experienced challenges monitoring the file? I noticed alwaysOpenFile=1 in your configuration. This isn't usually necessary if Splunk can see the log was updated using its other detection mechanisms (timedate stamp, size, etc)

(1) You can use the GUI or CLI to export to xml, csv, txt

(2) Splunk monitors log files but does not delete them. You should use your standard log rotation strategies to retain application and OS logs according to your needs.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...