Splunk Search

What version of Splunk can receive traps via SNMPv3?

splunk_user_btr
New Member

If yes, is there any specific documentation about configuration of Splunk for SNMPv3?

Thanks

Tags (1)
0 Karma

sigma9r
New Member

According to my rep, SNMPv3 is in the works but it's not one of their top priorities.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Splunk cannot directly receive SNMP traps for ANY version of SNMP. It does not understand the ASN.1 on-the-wire format and does not have the necessary MIBs to format the trap. Splunk depends on software like snmptrapd to receive the trap off-of-the-wire and then format it into plain text format.

One option for receiving the trap off of the wire is snmptrapd from the NET-SNMP distribution. There is a tutorial on the NET-SNMP site that discusses how to configure it to receive SNMPv3 traps.

Once you have this snmptrapd in place receiving the traps then configuring Splunk to index them should be relatively easy.

ampledata
Splunk Employee
Splunk Employee

Here's a link to some Splunk Documentation discussing receiving SNMP:

http://docs.splunk.com/Special:SplunkSearch/docs?q=snmp

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...