All Apps and Add-ons

,A10 Networks SLB

New Member

I am not getting data in the app itself but I see it in the index, I have updated the port in the props.conf do I also have to specify something for the source?

Source Typing

[source::udp:1301]
TRANSFORMS-stforslb = a10slb
TRANSFORMS-st
forwaf = a10waf

Avoids indexing keepalive msgs

TRANSFORMS-nullkeepalive = a10keepalive_null
,I am not getting data in the APP itself, I see data in the database but it isnt populating the app. I have changed the port in the props.conf

Source Typing

[source::udp:1301]
TRANSFORMS-stforslb = a10slb
TRANSFORMS-st
forwaf = a10waf

Avoids indexing keepalive msgs

TRANSFORMS-nullkeepalive = a10keepalive_null

Do I need to specify something for source also in this file?

Tags (1)
0 Karma

Explorer

Hi Conner40744,

Could you please check that the data source is the one that has been defined in your files?

If it's OK, please make sure that new props and transforms are applied.

You can restart Splunk to be sure.

Thanks,

Open3S,

0 Karma