SNMP Traps

Overview

SNMP traps are pushed device events. Telegraf receives them through the SNMP Trap input plugin, enriches them with generated inventory metadata, and sends them to Splunk.

Architecture

graph LR
    A[Device Trap Configuration] --> B[Network and Anycast Ingress]
    B --> C[Telegraf SNMP Trap Receiver]
    D[Generated Trap Inventory Metadata] --> C
    C --> E[Splunk Universal Forwarder Path]
    E --> F[Splunk snmp_traps Index]

Telegraf Configuration

The deployed configuration defines the listener, supported MIBs/OIDs, parsing, inventory lookup, output path, and runtime resources. Credentials and SNMPv3 authentication/privacy data must remain in approved secret storage.

Splunk Index

Traps are stored in snmp_traps. Search by a stable device identifier and a narrow time range, then inspect the event fields before adding device-specific filters.

index=snmp_traps earliest=-30m device_name="<device_name>"
| sort 0 _time

Common Trap Types

Common categories include interface/link state, hardware/environmental faults, HA/failover state, routing or adjacency changes, authentication/security events, and application/platform alarms. Exact trap support depends on the device MIB and source configuration.

When traps are missing, verify source destination/security settings, network reachability, receiver health, consolidated trap metadata, source-address matching, and Splunk forwarding.