All Apps and Add-ons

Any description of collected data

mjaeger
New Member

Hi,
I've installed the TA for F5 and startet collecting data using the original templates - and it would be very helpfull to have any kind of description of the collected values. I've tried to find some more information at the F5 web site (devcentral), but besides a documentation about the icontrol interface there was nothing realy usefull.

Currently I'm trying to find out how to interpret the CPU and RAM values from the "f5:bigip:system:systeminfo:icontrol" template...

Thanks
Martin

0 Karma
1 Solution

lding_splunk
Splunk Employee
Splunk Employee

Hi Martin,

Sorry to bring you trouble for this.
Let me clarify your question:
1. You have successfully installed the add-on, connected to F5 BIG-IP, and can collect some data by defining a task which uses the F5 BIG-IP server and uses the standard collection template "Standard_System".
2. Your question is "how to use the data in search language and understand the format of those data which you have already indexed into Splunk for sourcetype: f5:bigip:system:systeminfo:icontrol, right?

Answers:

  1. As mentioned in below link, you can see the format of those indexed data are actually JSON format which is mapped the data format from F5 BIG-IP iControl SDK. http://docs.splunk.com/Documentation/AddOns/latest/F5BIGIP/Createnewtemplates
  2. Every index data will has a field named "module_interface", for example, "module_interface": "System.SystemInfo", the format of the content could be got from: https://devcentral.f5.com/wiki/iControl.System__SystemInfo.ashx https://devcentral.f5.com/wiki/icontrol.apireference.ashx
  3. Take CPU and RAM usage as example as you mentioned, below SPL are examples as reference, which will show the CPU trend, another one is RAM usage trend: sourcetype="f5:bigip:system:systeminfo:icontrol" cpu_usage_percent=* sourcetype="f5:bigip:system:systeminfo:icontrol" memory mem_used=*

View solution in original post

0 Karma

lding_splunk
Splunk Employee
Splunk Employee

Hi Martin,

Sorry to bring you trouble for this.
Let me clarify your question:
1. You have successfully installed the add-on, connected to F5 BIG-IP, and can collect some data by defining a task which uses the F5 BIG-IP server and uses the standard collection template "Standard_System".
2. Your question is "how to use the data in search language and understand the format of those data which you have already indexed into Splunk for sourcetype: f5:bigip:system:systeminfo:icontrol, right?

Answers:

  1. As mentioned in below link, you can see the format of those indexed data are actually JSON format which is mapped the data format from F5 BIG-IP iControl SDK. http://docs.splunk.com/Documentation/AddOns/latest/F5BIGIP/Createnewtemplates
  2. Every index data will has a field named "module_interface", for example, "module_interface": "System.SystemInfo", the format of the content could be got from: https://devcentral.f5.com/wiki/iControl.System__SystemInfo.ashx https://devcentral.f5.com/wiki/icontrol.apireference.ashx
  3. Take CPU and RAM usage as example as you mentioned, below SPL are examples as reference, which will show the CPU trend, another one is RAM usage trend: sourcetype="f5:bigip:system:systeminfo:icontrol" cpu_usage_percent=* sourcetype="f5:bigip:system:systeminfo:icontrol" memory mem_used=*

View solution in original post

0 Karma

mjaeger
New Member

Hi,

Thank you for your answer. I hope that this information will help me to get more about the data collected with this TA.

Regards
Martin

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.