All Apps and Add-ons

Some sources are empty causing several panels not to load correctly

rvdvelpe
Engager

Hi,

First of all the app looks very promising!

I bump into the problem that certain sources are empty.
I've looked into the searches and it seems that the following sources are empty:

source=bigip.istats.ssli
source=bigip.objectmodel.cert
source=bigip.avrstats.AVR_STAT_VIP
source=bigip.adm
source=bigip.syslog
source=bigip.log*
source=bigip.snmptrap

I could miss some, but the others seems oké. What could cause that only these sources are empty? How do I troubleshoot this.

iApp version: f5.analytics.v3.7.1rc2
BigIP version: BIG-IP 12.1.1 Build 2.0.204 Hotfix HF2

I followed the deployment guide, except that the index is called "f5_analytics" instead" of "f5-default". I also changed the macro f5_index.


Below a overview of the sources:

index=f5_analytics
| stats count(source) as countSource by source
| sort - countSource

source,countSource
"bigip.tmstats.pool_member_stat",42042
"bigip.tmsh.pool_member_status",40796
"bigip.tmstats.pool_stat",31780
"bigip.tmstats.memory_usage_stat",13020
"bigip.objectmodel.virtual.profiles",11060
"bigip.tmstats.rule_stat",8868
"bigip.tmstats.profile_tcp_stat",4984
"bigip.objectmodel.virtual.rules",3192
"bigip.objectmodel.virtual",3108
"bigip.tmsh.virtual_status",3108
"bigip.tmstats.virtual_server_cpu_stat",3108
"bigip.tmstats.virtual_server_stat",3108
"bigip.tmstats.profile_clientssl_stat",3094
"bigip.objectmodel.virtual.pools",2072
"bigip.sessiondb",1904
"bigip.tmstats.profile_serverssl_stat",1736
"bigip.objectmodel.rule.pools",1484
"bigip.tmstats.profile_httpcompression_stat",700
"bigip.tmsh.disk_latency",532
"f5_app_kpi",365
"bigip.tmsh.disk_usage",364
"bigip.tmstats.ifc_stats",350
"bigip.tmstats.profile_udp_stat",280
"bigip.tmstats.interface_stat",252
"bigip.tmstats.profile_connpool_stat",252
"bigip.tmstats.profile_webacceleration_stat",224
"bigip.tmsh.interface_status",140
"bigip.tmstats.cpu_info_stat",112
"bigip.tmstats.profile_ftp_stat",56
"bigip.stats.summary",28
"bigip.tmsh.system_status",28
"bigip.tmstats.disk_info_stat",28
"bigip.tmstats.host_info_stat",28
"bigip.tmstats.ip_stat",28

Best regards,
Ruud.

evolutionxtinct
Explorer

@rvdvelpe,

Were you able to figure this out? I get basically the same SourceTypes as you, but some panels like Application panels are not showing data, when I look at searches they show up as "Undefined" in the search query which makes no sense...

0 Karma

suarezry
Builder

ssh to the F5 LTM, look at /var/log/ltm to see if there are any errors with the transfer to splunk

0 Karma

evolutionxtinct
Explorer

I'm receiving these errors in the LTM log, but not sure how to resolve.

Jan 15 03:44:03 f5-bigip-n1 info audit_forwarder: audit_forwarder started.
Jan 15 03:44:05 f5-bigip-n1 err scriptd[13853]: 014f0013:3: Script (/Common/Splunk-send_stats) generated this Tcl error: (script did not successfully complete: (01020036:3: The requested RADIUS Server (/Comm
on/Splunk.app) was not found.     while executing "tmsh::get_config auth radius-server /Common/$appname.app/$radius_ihealth"     invoked from within "lindex [tmsh::get_config auth radius-server /Common/$appn
ame.app/$radius_ihealth] 0"     invoked from within "set obj [lindex [tmsh::get_config auth radius-server /Common/$appname.app/$radius_ihealth] 0]" line:41))
Jan 15 03:44:05 f5-bigip-n1 notice mcpd[5856]: 0107167d:5: Data publisher not found or not implemented when processing request (unknown request), tag (2901).
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...