topic Entries in F5 Network App not populating data in Splunk Search

Entries in F5 Network App not populating data

singriajay — Mon, 01 Jul 2019 08:39:47 GMT

Hi,

I am getting LTM, ASM, APM logs from F5 devices over UDP port 9514 and I have bifurcated the inputs.conf file and I am able to find the sourcetype entries in normal search. Whereas I am unable to see any entries in F5 Network App.

Re: Entries in F5 Network App not populating data

mdsnmss — Mon, 01 Jul 2019 16:46:00 GMT

What index is the F5 data stored in? Does your role search that index by default? Either way, the app should specify an index macro, but it only does sourcetypes. If you don't have the index searched by default it won't point to an index to search. You can update this in
Settings-->Advanced Configuration-->Search Macros and then navigate to the F5 app. For each of the macros append index=<your-F5-index> to the beginning of the macro.

Re: Entries in F5 Network App not populating data

singriajay — Wed, 30 Sep 2020 01:08:48 GMT

I am using the "main" index as of now.

f5_index source=$kpi_type$ where1="$where1$" where2="$where2$" is the content present in the app. Should I append for all the macros with index=main in place of f5_index?

Re: Entries in F5 Network App not populating data

mdsnmss — Tue, 02 Jul 2019 11:26:28 GMT

So it does look like it uses an index macro. I must have been looking at the wrong F5 Network app. Then my answer still applies. Go to Settings-->Advanced Configuration-->Search Macros and find f5_index. You should see it define index=. Just change that to main and it should change throughout the entire app.

Re: Entries in F5 Network App not populating data

singriajay — Tue, 02 Jul 2019 13:16:29 GMT

This is working fine. Thank you