I have recently installed the F5 Analytics app and it works well with one exception.
For some reason that I am unable to figure out, on the Dashboard, the non-responding hosts section lists every device that is monitored in Splunk (we also monitor Syslog from several hundred network devices).
Any idea how to fix this?
Ideally you should be sending data from the HTTP Event Collector for F5 Devices to a specific index example: f5-default. If you have all of the BIG-IPs going to F5 only indexes you would then update the f5_index macro to index name and that will prevent all hosts from being listed.
I can't believe that I missed that index=* line. Index updated and it works as expected. Thank you
we did define specific index name in f5_index macro, still we see different hosts in non-responding hosts...did you get this resolved...??
Also interested in if this was resolved?