https://community.splunk.com/t5/Splunk-Enterprise/F5-Source-Type-Indexing/m-p/504539#M1981 <P>Hi, I have just begun ingesting F5 logs, I am not using the modular inputs component at present and am only seeing ASM logs via syslog. Logs are being sent to a syslog server and file monitoring is set to pull into splunk indexer. But when searching logs the logs dont seem to be separating expected "dur<SPAN>ing index time, the add-on separates the data into more specific source types."</SPAN></P><P>I have an inputs.conf file on the rsyslog server distributed by a universal forwarder.</P><P>[monitor:..........]</P><P>disabled = 0</P><P>host_segment = 5</P><P>index=f5</P><P>sourcetype= f5:bigip:syslog</P><P>I have removed the inputs from the indexer and have added the add-on to the search head as well. Confused as to why the logs are separating. Hoping someone can help</P><P>Cheers</P> Tue, 16 Jun 2020 06:24:34 GMT heidihart 2020-06-16T06:24:34Z https://community.splunk.com/t5/Splunk-Enterprise/F5-Source-Type-Indexing/m-p/504539#M1981 <P>Hi, I have just begun ingesting F5 logs, I am not using the modular inputs component at present and am only seeing ASM logs via syslog. Logs are being sent to a syslog server and file monitoring is set to pull into splunk indexer. But when searching logs the logs dont seem to be separating expected "dur<SPAN>ing index time, the add-on separates the data into more specific source types."</SPAN></P><P>I have an inputs.conf file on the rsyslog server distributed by a universal forwarder.</P><P>[monitor:..........]</P><P>disabled = 0</P><P>host_segment = 5</P><P>index=f5</P><P>sourcetype= f5:bigip:syslog</P><P>I have removed the inputs from the indexer and have added the add-on to the search head as well. Confused as to why the logs are separating. Hoping someone can help</P><P>Cheers</P> Tue, 16 Jun 2020 06:24:34 GMT https://community.splunk.com/t5/Splunk-Enterprise/F5-Source-Type-Indexing/m-p/504539#M1981 heidihart 2020-06-16T06:24:34Z