So, if you wanted to spin it into a key=value pair to make it nice and easy for Splunk, you could do something in Python like this: import subprocess, re snmp_proc = subprocess.Popen('snmpget -v <snmp version> -c <community string> <IP> <OID>', shell=True, stdout=subprocess.PIPE) raw_oid_value = snmp_proc.stdout.read() oid_value = re.match('^.*Counter64:\s(?P<number>.*?)$', raw_oid_value) print "snmp_key=" + oid_value Or, you could just use something simple from a sh script and do all of the parsing in Splunk: snmpget -c <community string> -v <snmp version> <IP> <OID> ... View more

Splunk should already parse out each section, splitting on the timestamp, to a separate "record". This regex will work for the sample you've provided: rex "(?m)(? .+)\n(? . +)\n(? .+)\n(? . +)\n(? .*+)" ... View more