splunk for f5 Networks - please correct spelling

EricPartington — Thu, 20 Oct 2011 20:35:17 GMT

i think you have some spelling mistakes in your transforms

transforms.conf:

[no_memebers_available]

please fix name to be members (also update props.conf entry to match)

[pool_member_src_ip_2]

REGEX = Pool member(.*) monitor satus down
FORMAT = src_ip::$1

you have an extra space on the line as well STATUS is spelled incorrectly (missing t)

could you follow the common information naming model listed on your website for this extraction?

[pool_member_src_prt]
REGEX = Pool member.*:(.*)monitor
FORMAT = src_prt::$1 
use src_port instead of src_prt

please update all searches that leverage these changes to match

is it possible to change the saved searches to use a macro for the sourcetype? I have a different sourcetype name for the same data and dont want to change my extractions, if there was a macro (ltm_sourcetype => sourcetype=ltm_log ) that i could change to suit my name and add an index if posible that would make it easier for me to update this app to match my requirements.

Re: splunk for f5 Networks - please correct spelling

rblair978 — Thu, 25 Jul 2013 00:18:48 GMT

Thank you for bringing this to our attention.

These changes have been applied and I will send Splunk an updated Application for distribution.

With regards to a macro sourcetype: I will need to discuss this with my Splunk contact.

topic Re: splunk for f5 Networks - please correct spelling in Getting Data In

splunk for f5 Networks - please correct spelling

Re: splunk for f5 Networks - please correct spelling