If I need to accept an SNMP trap from a source, and send it to multiple trap destinations, will Cribl spoof the source IP and send the trap “un-altered” to the final destinations? Meaning will it preserve the source IP address from the original trap IP header?
Cribl will receive the trap as per config, and any pre, pro or post processing is in your hands.
The message should be sent on with the original source ip in the message, however the receving syslog sources will define if it uses this or the host sending the message.
See here for more info: