Dashboards & Visualizations

F5/Splunk App - LTM dashboard

ebaycmille
New Member

Hello, just curious if anyone has had success getting this to work? Are there any config docs available?

0 Karma

cps42
Explorer

I came upon this thread a bit late, but with the advent of v10 / v11 software, and multimodule Big-IP systems (WAM + ASM + LTM on one system, for example), I've found a different tack on the transforms.conf. You can see some of it in the $SPLUNK_HOME/etc/apps/SplunkforF5/default/ config files.

Each of the modules that runs through AlertD will prepend the log message with a number in this format:


REGEX = (\d{4}[0-9A-Fa-f]{4}:\d+:).

For example, the apm_log regex is


transforms.conf:REGEX = :\s(?:0149[0-9A-Fa-f]{4}:\d+:|0125[0-9A-Fa-f]{4}:\d+:\s[0-9A-Fa-f]{8}:)

Make sure your props.conf file calls those dynamic transforms out, and then you don't have to manually define every LTM on your network in transforms.conf.


TRANSFORMS-f5 = firepass_sourcetyper, asm_sourcetyper, apm_sourcetyper, irule_sourcetyper, PSM_sourcetyper_smtp, PSM_sourcetyper_http, PSM_sourcetyper_ftp, bigip_sourcetyper

0 Karma

MarioM
Motivator

yes if everything is coming on same udp port you can force the sourcetype by host by modifying(or creating) props.conf and transforms.conf in either splunk/etc/system/local,splunk/etc/apps/myapps/local,splunk/etc/apps/SplunkforF5/local:

In transforms.conf for example:

[assign_sourcetype_bigip]
SOURCE_KEY=MetaData:Host
DEST_KEY=_MetaData:Sourcetype
REGEX=^host::(10\.10\.10\.1|10\.10\.10\.2)$
FORMAT=ltm_log

In props.conf:

TRANSFORMS-force-bigip-sourcetype = assign_sourcetype_bigip
0 Karma

charlestips
Explorer

How do you set the manual source type? Everything is coming in on one port, is it possible to set the source type based on the host sending it?

0 Karma

MarioM
Motivator

First make sure your data inputs have the right manual sourcetype:

LTM ltm_log

GTM gtm_log

ASM asm_log

PSM psm_log

Firepass firepass_log

The app has many scheduled searches, including some that feed the summary index then you need to wait they kick off and summary index being filled before things shows up in dashboard.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...