- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Sending SNMP to Splunk
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sending SNMP to Splunk
Still have some doubts about sending SNMP to Splunk
http://docs.splunk.com/Documentation/Splunk/latest/Data/SendSNMPeventstoSplunk
About this step:
Edit C:\usr\etc\snmp\snmptrapd.conf:
snmpTrapdAddr [System IP]:162
authCommunity log [community string]
Is the system IP the one which Splunk is installed on?
I am able to create the log file on the local machine, but it always states:
couldn't open udp:162 -- errno 2 ("No such file or directory")
Are there any other configuration do I need?
Thanks very much.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you're having problems with snmp modular input, may want to give this a try.
https://answers.splunk.com/answers/521362/found-a-simple-snmp-trap-receiver-for-windows-that.html#an...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
So I have SNMPD running, however no SNMP traps are being written tp snmptrapd.log. I have installed wireshark and can see that the traps have arrived on the correct interface with the correct community.
Any ideas?
Thankyou
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check out this new add-on : http://splunk-base.splunk.com/apps/88686/snmp-modular-input
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you can put something like this:
snmpTrapdAddr udp:0.0.0.0:162
authCommunity log,execute,net public
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
