,A10 Networks SLB

[Conner40744]

I am not getting data in the app itself but I see it in the index, I have updated the port in the props.conf do I also have to specify something for the source?

Source Typing

[source::udp:1301]
TRANSFORMS-st_for_slb = a10_slb
TRANSFORMS-st_for_waf = a10_waf

Avoids indexing keepalive msgs

TRANSFORMS-null_keepalive = a10_keepalive_null
,I am not getting data in the APP itself, I see data in the database but it isnt populating the app. I have changed the port in the props.conf

Source Typing

[source::udp:1301]
TRANSFORMS-st_for_slb = a10_slb
TRANSFORMS-st_for_waf = a10_waf

Avoids indexing keepalive msgs

TRANSFORMS-null_keepalive = a10_keepalive_null

Do I need to specify something for source also in this file?

[open3s]

Hi Conner40744,

Could you please check that the data source is the one that has been defined in your files?

If it's OK, please make sure that new props and transforms are applied.

You can restart Splunk to be sure.

Thanks,

Open3S,