I am not getting data in the app itself but I see it in the index, I have updated the port in the props.conf do I also have to specify something for the source?
[source::udp:1301]
TRANSFORMS-st_for_slb = a10_slb
TRANSFORMS-st_for_waf = a10_waf
TRANSFORMS-null_keepalive = a10_keepalive_null
,I am not getting data in the APP itself, I see data in the database but it isnt populating the app. I have changed the port in the props.conf
[source::udp:1301]
TRANSFORMS-st_for_slb = a10_slb
TRANSFORMS-st_for_waf = a10_waf
TRANSFORMS-null_keepalive = a10_keepalive_null
Do I need to specify something for source also in this file?
Hi Conner40744,
Could you please check that the data source is the one that has been defined in your files?
If it's OK, please make sure that new props and transforms are applied.
You can restart Splunk to be sure.
Thanks,
Open3S,