Integrations

Collecting SNMP Traps with Cribl Stream

Network device traps into the pipeline, one source at a time.

February 19, 2026
7 min read

SNMP traps in a pipeline

Cribl Stream supports receiving data from SNMP traps. Per the SNMP Trap Source documentation, this Source is of Push type, has no TLS support, and no Event Breaker support either. Any device that can emit SNMP traps pushes them into Stream over UDP, and Stream decodes each packet, so you can act on the SNMP metadata: drop it, route it, forward the packet verbatim to another SNMP destination, or deliver the data to non-SNMP destinations such as Splunk, Syslog, and S3.

Setting up the trap source

On the top bar, select Products and then Cribl Stream, and under Worker Groups select a Worker Group. Two paths add the Source: Routing > QuickConnect (Stream) or Collect (Edge), where you select Add Source and choose Select Existing or Add New; or Data > Sources (Stream), More > Sources (Edge), select the Source, then Add Source.

In the New Source modal, the General Settings are:

One detail changes which port you use: except in Cribl.Cloud, Cribl Stream ships with an SNMP Trap Source preconfigured to listen on port 9162. Clone it or modify it directly, then enable it. Finish with Save and Commit & Deploy.

Authentication. SNMPv3 authentication provides secure access through optional user authentication and decryption of incoming data packets, at three levels: user name checking without authentication, user authentication without privacy, or user authentication with privacy. Toggle SNMPv3 authentication on to reveal the parameters and add at least one user via v3 Name; Add user adds more credentials. The authentication protocol, authentication key, privacy protocol, and privacy key can all be unique per user. For authentication to succeed, the user name, protocol, and key must match between the Source and the device, and decryption additionally requires the privacy protocol and key to match.

Cribl Stream logs authentication failures at the debug level, and decryption failures at the debug level as well.

Persistent queue. The Persistent Queue Settings tab buffers and preserves incoming events when a downstream Destination has an outage or backpressure. On Cribl-managed Cloud Workers (Enterprise plan), only the Enable persistent queue toggle is exposed; enabled, PQ runs in Always On mode with a maximum of 1 GB of disk per PQ-enabled Source, per Worker Process. On on-prem and hybrid deployments, the full controls apply:

In Cribl Stream 4.1 and newer, the Source persistent queue default Mode is Always On.

Processing. In Fields, you can define new fields or modify existing ones with JavaScript expressions, similar to the Eval function: a Field Name (new or existing) and a Value expression that computes it, including a constant. In Pre-Processing, a single existing Pipeline or Pack can process this input's data before it goes through the Routes.

Advanced. Include varbind types puts varbind types into the varbinds field on each event and is required for the SNMP Trap Serialize Function when serializing to an SNMP Trap Destination (off by default). IP allowlist regex matches the IPs allowed to send data (defaults to .*, all IPs). Buffer size limit (events) caps events buffered while downstream blocks (defaults to 1000). UDP socket buffer size (bytes) sets the SO_RCVBUF socket option (minimum 256, maximum 4294967295; blank uses the OS default). Environment scopes the configuration to a single Git branch under GitOps.

Connected Destinations. Select Send to Routes for conditional routing, filtering, and cloning via the Routing table, or QuickConnect for direct connections to one or more Destinations. For troubleshooting: the configuration modal's Live Data tab (Start Capture shows events as ingested) and Logs tab surface errors and warnings, and the Monitoring page charts volume and rate.

What the events look like

The docs page shows no rendered sample event, but the SNMP Trap Source documentation does list the internal, "meta" fields this Source uses. They are not part of an event, but Functions can use them to make processing decisions:

The format of __srcIpPort, per the docs:

event.__srcIpPort = ${rInfo.address}|${rInfo.port};

With Include varbind types on, the varbinds field parses to an array of objects like this:

[{oid: string, value: any, type: number}]

What the docs flag

Frequently asked questions

Does the Cribl Stream SNMP Trap Source support TLS?

No. The SNMP Trap Source in Cribl Stream does not support TLS and has no Event Breaker support either. It is a Push type Source that receives traps over a UDP port, with a default of 162.

What SNMPv3 security levels can the Cribl Stream trap Source enforce?

Cribl Stream supports three levels of SNMPv3 security: user name checking without authentication, user authentication without privacy, and user authentication with privacy. Authentication protocols can be None, MD5, SHA1, SHA224, SHA256, SHA384, or SHA512, and privacy protocols can be None, AES128, AES256b, or AES2556r.

How are incoming SNMP traps handled by Cribl Stream?

Incoming traps can be forwarded to other SNMP destinations, but their contents cannot be modified and the packets are forwarded verbatim. The trap data can also be delivered to non-SNMP destinations such as Splunk, Syslog, or S3. Non-SNMP input data cannot be sent to SNMP destinations.

Which internal fields does the Cribl Stream SNMP Trap Source expose?

The Source exposes a set of internal fields, including __didDecrypt, __snmpRaw, __snmpVersion, __srcIpPort, __inputId, __final, and _time. These meta fields are not part of the event, but Functions can use them to make processing decisions.

Source

Verified against Cribl Stream 4.20 documentation on February 19, 2026.