icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading SNMP Modular Input Poller
SHA256 checksum (snmp-modular-input-poller_254.tgz) bb22cd21d7525a394b6058a3eb4c71c2e56641244437e93a23d614ad908f698e SHA256 checksum (snmp-modular-input-poller_253.tgz) dc2cbd5f78576e12146b2323a854c260d209e19a88abe37f47138d24e6e7b205 SHA256 checksum (snmp-modular-input-poller_251.tgz) b6d67034ebfba0564b7ab7ca8a1d905e33531b8fa8abad0c2f88c8fcb1ba7a4b SHA256 checksum (snmp-modular-input-poller_250.tgz) e2bd879d7dde24cf14524db1a04583b70b854d8e0341295cb61d5519615d5047 SHA256 checksum (snmp-modular-input-poller_240.tgz) c35b87efed7439549cbf98e9d8fa1da93ee2a07e2454581fa9dd434d3cb05606 SHA256 checksum (snmp-modular-input-poller_230.tgz) ebce6b1378448b764a5af674c1efa76fa46b1268e4662b11b840129d0427a485 SHA256 checksum (snmp-modular-input-poller_221.tgz) a1b06f38a8d3659cea4f3342ea73380329c4e54c97347222a35f30ee5f1a1f0e SHA256 checksum (snmp-modular-input-poller_220.tgz) 54c7a9bddf8f3f4b37f2e6ae73182bc52de748da1f73ba15f2b54a080ae4126a SHA256 checksum (snmp-modular-input-poller_212.tgz) 2183d57815c7ea62be8ace664507b64c4159bb47512a515cdf4b0c6236d46ae6 SHA256 checksum (snmp-modular-input-poller_201.tgz) 22beab6b1fb5d189b7d1def94273217eb9ef727a2f7668efb4c90a3afc18b013 SHA256 checksum (snmp-modular-input-poller_200.tgz) 2471daac8058c6b2aa00e566ec8c264968a4b03f0fe7993bab5ff1d8d12fa4f4
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

SNMP Modular Input Poller

Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
SNMP Interface & IPSLA statistic poller

[snmpif://hostname]
destination = hostname
snmp_version = 3
v3_securityName = username
v3_authKey = password
snmpinterval = 300
interfaces = 1,5,8,9
index = network
# The sourcetype can be whatever you want
sourcetype = snmpif


[ipsla://hostname]
destination = hostname
snmp_version = 3
v3_securityName = username
v3_authKey = password
snmpinterval = 300
operations = 2,7
index = network
sourcetype = ipsla

SnmpMod

Deployment

splunk install app snmpmod.spl -update 1 -auth admin:changeme
cd $SPLUNK_HOME/etc/apps/snmpmod
mkdir local
vim local/inputs.conf

SNMP v3

If you are using SNMP version 3 , you have to obtain the PyCrypto package yourself:

As of Python 2.7.9, pip is included with the release. Run

pip2 install pycrypto
  • Windows
  • Copy C:\Python27\Lib\site-packages\Crypto to $SPLUNK_HOME\etc\apps\snmpmod\bin
  • Linux
  • Copy /usr/local/lib/python2.7/dist-packages/Crypto to $SPLUNK_HOME/etc/apps/snmpmod/bin

snmpif Stanza

[snmpif://hostname]
destination = hostname
snmp_version = 3
v3_securityName = username
v3_authKey = password
snmpinterval = 300
interfaces = 1,5,8,9
index = network
# The sourcetype can be whatever you want
sourcetype = snmpif

ipsla Stanza

[ipsla://hostname]
destination = hostname
snmp_version = 3
v3_securityName = username
v3_authKey = password
snmpinterval = 300
operations = 2,7
index = network
sourcetype = ipsla

Response Handlers

destination, host and /etc/hosts

Currently, all response handlers set the Splunk host to the value of destination. If you don't have DNS (bad sysadmin!) add an entry to /etc/hosts. I'd be very happy to take a pull request that will look at a host config option and override destination with that value.

SNMP Interface Search Query

I strongly recommend you create a search macro snmpif_traffic that uses streamstats to calculate the bits per second from the raw snmpif data. My macro is:

stats first(*) as * by _time host ifIndex
| streamstats window=2 global=false current=true range(if*Octets) as delta*, range(_time) as secs by host, ifIndex
| where secs>0
| eval bpsIn=coalesce(deltaHCIn, deltaIn)*8/secs
| eval bpsOut=coalesce(deltaHCOut, deltaOut)*8/secs
| eval mbpsIn=bpsIn/1000000 | eval mbpsOut=bpsOut/1000000

Then to call it and display the results as a graph:

index=snmpif host=foo ifIndex=17 | `snmpif_parse`
| timechart bins=500 avg(mbpsIn) as "Mbps IN", avg(mbpsOut) as "Mbps OUT"

And calculate 95th percentile figures

index=snmpif host=foo ifIndex=17 | `snmpif_parse`
| stats perc95(mbpsIn) as "IN", perc95(mbpsOut) as "OUT"

Summary Collection

The search term shown above is quite expensive. I am running the query above and collecting the data into a new index.

[search index=network sourcetype=snmp_traffic | stats first(_time) as earliest] index=network sourcetype="snmpif"
| stats first(*) as * by _time host ifIndex
| streamstats window=2 global=false current=true range(if*Octets) as delta*, range(_time) as secs by host, ifIndex
| where secs>0
| eval bpsIn=coalesce(deltaHCIn, deltaIn)*8/secs
| eval bpsOut=coalesce(deltaHCOut, deltaOut)*8/secs
| eval mbpsIn=bpsIn/1000000
| eval mbpsOut=bpsOut/1000000
| fields _time host ifIndex bpsIn bpsOut ifAdminStatus ifDescr ifMtu ifOperStatus ifPhysAddress ifSpecific ifSpeed ifType mbpsIn mbpsOut
| collect index=network sourcetype=snmp_traffic

There is a trick there of using the most recent snmp_traffic event to start the next round of collections. I run this search every 30 minutes.

About

This project was originally based on SplunkModularInputsPythonFramework.
I have taken the SNMP modular input, refactored the python code to be more re-usable and added extra stanzas for polling interfaces and ipsla statistics.

Release Notes

Version 2.5.4
April 1, 2016

## v2.5.4
* More changes to error handling

Version 2.5.3
March 24, 2016

# Release Notes

## v2.5.3
* Fixes and tweaks to logging

## v2.5.2
* Significant improvements to logging

Version 2.5.1
Feb. 2, 2016

## v2.5.1
* [Issue #3](https://github.com/oxo42/snmpmod/issues/3): Fixed statistics coming through

Version 2.5.0
Jan. 18, 2016

## v2.5.0
* [Issue #2](https://github.com/oxo42/snmpmod/issues/2): Added `dropBitRate` to `qos`

## v2.4.0
* Added `qos` section for querying CB QOS policy rates

## v2.3.0
* Added jitter stats packet loss counters to IPSLA

## v2.2.1
* Increase transport timeout to 2 seconds

## v2.2.0
* Added RTT Sum2 to IPSLA poller
* Added operation response to IPSLA poller
* Added high counter Ucast packets to snmpif

## v2.1.2
* Removed RTTSumHigh from IPSLA

## v2.1.1
* Renamed IPSLA entry to operation

Version 2.4.0
Nov. 13, 2015

* Added `qos` section for querying CB QOS policy rates

Version 2.3.0
July 1, 2015

## v2.3.0
* Added jitter stats packet loss counters to IPSLA

## v2.2.1
* Increase transport timeout to 2 seconds

## v2.2.0
* Added RTT Sum2 to IPSLA poller
* Added operation response to IPSLA poller
* Added high counter Ucast packets to snmpif

## v2.1.2
* Removed RTTSumHigh from IPSLA

## v2.1.1
* Renamed IPSLA entry to operation

Version 2.2.1
June 18, 2015

Increase transport timeout to 2 seconds

Version 2.2.0
May 15, 2015

## v2.2.0 Changelog
* Added RTT Sum2 to IPSLA poller
* Added operation response to IPSLA poller
* Added high counter Ucast packets to snmpif

Version 2.1.2
April 23, 2015

# Breaking change
Renamed IPSLA entry to operation

Version 2.0.1
March 20, 2015

Bug fix release

Version 2.0.0
March 20, 2015

* Added support for polling CISCO IPSLA statistics via [ipsla:// stanza
* Fixed up exception handling
* Tweaked logging

47
Installs
1,701
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2019 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.