Hello Friends I am facing issues that may be caused by input.conf but I am not able to get bottom of the problemwhen I search index=network "*f5*"
in which 2 types of sourcetype are coming f5:bigip:syslogf5:bigip:asm:syslog
and certain event count against each sourcetype
when search index=network and sourcetype="*f5*",
then under index=networkf5:bigip:ltm:tcl:errorf5:bigip:syslog
but when I put index=network sourcetype="f5:bigip:asm:syslog"no events is found
I am collecting the data from f5 on a server (HF) and collecting the data on indexer from HF. Add on are installed but I am not sure whether its configured.
Input.conf contains entry for f5:bigip:syslog
can someone please help
RegardsGaurav@prakash007 @renjith_nair @jbsplunk