I am collecting SNMP trap from 1000+ devices. Here I want to send alert as soon as trap received.
But if I collect SNMP trap than index than run search and send alert its going to be add search burden to Splunk setup.
Is there any way as soon as Trap received, send it as alert. So that no indexing and search will happen ( this feature available in SNMP monitoring tools like Nagois, Zabix etc).
No. Splunk alerts run off indexed data.