Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading SNMP Modular Input
SHA256 checksum (snmp-modular-input_13.tgz) d755495b52a633bb82b763e0617f3acda7b4813b19aafeee56e6009a59c6f50d SHA256 checksum (snmp-modular-input_127.tgz) 14e53fa92978592bc827f68d6cfd730c3c419aad03c976d6b0d28b23eecd741b SHA256 checksum (snmp-modular-input_126.tgz) 87852fc2189767ca6ba05fbd7503425a731048987f9ccef66a4793e94e85fed3 SHA256 checksum (snmp-modular-input_125.tgz) 710ea19ab9b50d7d610b6fa2929a6d580c2740d9aab12e5f5546ef27f52cc953 SHA256 checksum (snmp-modular-input_124.tgz) e1829cfd32d4ddb4dd43e424e53ddde309d9a91ea09d5e6f9b471fcc01cfd67d SHA256 checksum (snmp-modular-input_123.tgz) b3db17f3149f7fe550448d2fe99d7c71c6fc4b42a641e92f0cca74192d845c8d SHA256 checksum (snmp-modular-input_122.tgz) bad407b4358d19952bd17f5649369b1f6821af704119d7cf75e7efa554cff31d SHA256 checksum (snmp-modular-input_121.tgz) 724b9c1663d77fb35796f500f26d66400c437a65d0e4b6b6b12b870d2c308bd2 SHA256 checksum (snmp-modular-input_12.tgz) 80db376ff21aa2c7e092280c5355fb42636bc9a149d5b49e9963b590a79cd221 SHA256 checksum (snmp-modular-input_106beta.tgz) c1d1e34f8866ced3100109f9e40e809bebdcc2a98f1fe861a1dc787e93894cd9 SHA256 checksum (snmp-modular-input_105beta.tgz) f43ba74f070ff1549fa909e23d14e29e1d1277d688e92610b45fe43caa925a13 SHA256 checksum (snmp-modular-input_104beta.tgz) e92cfcd179e4a7bd98ea8410c9535a4a5b163eef89c1b05723b6d6e21da327a3 SHA256 checksum (snmp-modular-input_103beta.tgz) 559a91dec2a96e2601bcafd4ddcca4eaf84dfe392747dec7ad9dd98572e665e0 SHA256 checksum (snmp-modular-input_102beta.tgz) 2bbec19246c130a2dcdd2b5342d085fcfbacf8b372fc894b4aab4a6e3d313128 SHA256 checksum (snmp-modular-input_101beta.tgz) 4b67d723df4bea3cfe72ff8f43bb5e7a97612317d2f816e76da387c61175099f SHA256 checksum (snmp-modular-input_10beta.tgz) ac4b7f60e4060acfb536988a924aa814b3778e9d3c6ad897046b2a82c072e274
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

SNMP Modular Input

Overview
Details
SNMP Modular Input to poll attribute values and catch traps

SNMP Modular Input v1.3

By Damien Dallimore

Overview

This is a Splunk modular input add-on for polling SNMP attributes and catching traps.

Activation Key

You require an activation key to use this App. Visit http://www.baboonbones.com/#activation to obtain a free,non-expiring key

Features

  • Simple UI based configuration via Splunk Manager
  • Capture SNMP traps (Splunk becomes a SNMP trap daemon in its own right)
  • Poll SNMP object attributes
  • SNMP version 1,2c and 3 support
  • Declare objects to poll in textual or numeric format
  • Ships with a wide selection of standard industry MIBs
  • Add in your own Custom MIBs
  • Walk object trees using GET BULK
  • Optionally index bulk results as individual events in Splunk
  • Monitor 1 or more Objects per stanza
  • Create as many SNMP input stanzas as you require
  • IPv4 and IPv6 support
  • Indexes SNMP events in key=value semantic format
  • Plug in your own custom response handler for formatting or pre-processing
  • Ships with some additional custom field extractions

Dependencies

  • Splunk 5.0+
  • Supported on Windows, Linux, MacOS, Solaris, FreeBSD, HP-UX, AIX

Setup

  • Untar the release to your $SPLUNK_HOME/etc/apps directory
  • Restart Splunk

SNMP Version 3 Crypto Libraries

If you are using SNMP version 3 , you have to obtain, build and add the pycrypto package yourself :

https://pypi.python.org/pypi/pycrypto

The simplest way is to build pycrypto and drop the "Crypto" directory in $SPLUNK_HOME/etc/apps/snmp_ta/bin.
I don't recommend installing the pycrypto package to the Splunk Python runtime's site-packages, this could have unforeseen side effects.

Building and installing PyCrypto

I do not bundle the pycrypto module with the core release , because :

  • you need to build it for each separate platform
  • US export controls for encrypted software

So , here are a few instructions for building and installing pycrypto yourself :

  • Download the pycrypto package from https://pypi.python.org/pypi/pycrypto

  • Then run these 3 commands (note : you will need to use a System python 2.7 runtime , not the Splunk python runtime)

    python setup.py build
    python setup.py install
    python setup.py test
    

3) browse to where the Crypto module was installed to ie: /usr/local/lib/python2.7/dist-packages/Crypto

4) Copy the "Crypto" directory to $SPLUNK_HOME/etc/apps/snmp_ta/bin

Adding Custom MIBs

The pysnmp library is used under the hood so you need to convert your plain text MIB files
into python modules :

Many industry standard MIBs ship with the Modular Input.
You can see which MIBs are available by looking in SPLUNK_HOME/etc/apps/snmp_ta/bin/mibs/pysnmp_mibs-0.1.4-py2.7.egg

Any additional custom MIBs need to be converted into Python Modules.

You can simply do this by using the build-pysnmp-mib tool that is part of the pysnmp installation. Note ,that you will need to install pysnmp version 4.2.5 in order to get the utility tools , as the latest releases of pysnmp no longer contain these tools.
https://pypi.python.org/pypi/pysnmp/4.2.5

build-pysnmp-mib -o SOME-CUSTOM-MIB.py SOME-CUSTOM-MIB.mib

build-pysnmp-mib is just a wrapper around smidump.

So alternatively you can also execute :

smidump -f python <mib-text-file.txt> | libsmi2pysnmp > <mib-text-file.py>

Then you can either copy the generated python files to SPLUNK_HOME/etc/apps/snmp_ta/bin/mibs or build a Python "egg" of
the generated python files(maybe tidier if you have many python files) and copy the egg to that same location.

In the configuration screen for the SNMP input in Splunk Manager , there is a field called “MIB Names” (see above).
Here you can specify the MIB names you want applied to the SNMP input definition ie: IF-MIB,DNS-SERVER-MIB,BRIDGE-MIB
The MIB Name is the same as the name of the MIB python module in your egg package.

Custom Response Handlers

You can provide your own custom Response Handler. This is a Python class that you should add to the
rest_ta/bin/responsehandlers.py module.

You can then declare this class name and any parameters in the SNMP Modular Input setup page.

For the most part the Default Response Handler should suffice.

But there may be situations where you want to format the response in a manner that is more convenient for handling your data ie: CSV or JSON.
Furthermore , you can also use a custom Response Handler implementation to perform preprocessing of your raw response data before sending
it to Splunk.

Logging

Any modular input log errors will get written to $SPLUNK_HOME/var/log/splunk/splunkd.log

Troubleshooting

  • You are using Splunk 5+
  • Look for any errors in $SPLUNK_HOME/var/log/splunk/splunkd.log

Release Notes

Version 1.3
May 27, 2018

Added an activation key requirement , visit http://www.baboonbones.com/#activation to obtain a free,non-expiring key
Docs updated
Splunk 7.1 compatible

Version 1.2.7
Nov. 20, 2014

Merged in community Pull requests.

Add a new option to get subtree
Add a new option to perform rDNS for trap source
Fix to resolve missing server extractions on the SNMPv3 trap receiver

Version 1.2.6
June 16, 2014

In the destination field for polling attributes , you can now optionally specify a comma delimited list of hosts

Version 1.2.5
June 13, 2014

Fixed Bug in UI that prevented declaring custom MIB Names when in listen traps mode

Version 1.2.4
May 17, 2014

Fixed host field extraction for receiving v2 traps

Version 1.2.3
March 28, 2014

Minor code tweaks

Version 1.2.2
Feb. 23, 2014

Updated the Manager UI to be simpler and more intuitive

Version 1.2.1
Feb. 13, 2014

Minor Cosmetic fixes

Version 1.2
Oct. 30, 2013

SNMP v3 support , please follow the docs regarding pycrypto dependencies

pysnmp library update to 4.2.5

Support for plugging in custom response handlers that can format the raw SNMP data in a particular format or perform preprocessing on the raw SNMP data before indexing in Splunk. Has a default response handler which produces the same output as previous versions.Also ships with an example JSONFormatterResponseHandler.

Robustified exception handling

More detailed logging

Version 1.0.6beta
July 29, 2013

Added more lenient exception handling code so that the trap listener won't terminate when it can't resolve an OID , and will instead just index the raw OID and print the error message to splunkd.log

Version 1.0.5beta
July 15, 2013

For custom MIBS , added the ability to drop plain python(.py) files into the bin/mibs directory , no need to egg them up

Version 1.0.4beta
June 27, 2013

Tweaked the Manager UI list view

Version 1.0.3beta
June 23, 2013

Got MIB resolution working properly for traps and attribute polling , added a config field so you can declare any MIB names you want applied, any custom MIBs still need to be converted into Python modules first(see the docs) ++ Added a config option to split out "get bulk" results into individually indexed events ++ changed the setup screen layout to be better organised

Version 1.0.2beta
June 20, 2013

Renamed the manager xml file to avoid naming clashes

Version 1.0.1beta
May 30, 2013

Some minor script tweaks around custom MIB loading

Version 1.0beta
May 23, 2013

1,053
Installs
18,798
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2018 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.