Hello, just curious if anyone has had success getting this to work? Are there any config docs available?
I came upon this thread a bit late, but with the advent of v10 / v11 software, and multimodule Big-IP systems (WAM + ASM + LTM on one system, for example), I've found a different tack on the transforms.conf. You can see some of it in the $SPLUNK_HOME/etc/apps/SplunkforF5/default/ config files.
Each of the modules that runs through AlertD will prepend the log message with a number in this format:
REGEX = (\d{4}[0-9A-Fa-f]{4}:\d+:).
For example, the apm_log regex is
transforms.conf:REGEX = :\s(?:0149[0-9A-Fa-f]{4}:\d+:|0125[0-9A-Fa-f]{4}:\d+:\s[0-9A-Fa-f]{8}:)
Make sure your props.conf file calls those dynamic transforms out, and then you don't have to manually define every LTM on your network in transforms.conf.
TRANSFORMS-f5 = firepass_sourcetyper, asm_sourcetyper, apm_sourcetyper, irule_sourcetyper, PSM_sourcetyper_smtp, PSM_sourcetyper_http, PSM_sourcetyper_ftp, bigip_sourcetyper
yes if everything is coming on same udp port you can force the sourcetype by host by modifying(or creating) props.conf and transforms.conf in either splunk/etc/system/local,splunk/etc/apps/myapps/local,splunk/etc/apps/SplunkforF5/local:
In transforms.conf for example:
[assign_sourcetype_bigip]
SOURCE_KEY=MetaData:Host
DEST_KEY=_MetaData:Sourcetype
REGEX=^host::(10\.10\.10\.1|10\.10\.10\.2)$
FORMAT=ltm_log
In props.conf:
TRANSFORMS-force-bigip-sourcetype = assign_sourcetype_bigip
How do you set the manual source type? Everything is coming in on one port, is it possible to set the source type based on the host sending it?
First make sure your data inputs have the right manual sourcetype:
LTM ltm_log
GTM gtm_log
ASM asm_log
PSM psm_log
Firepass firepass_log
The app has many scheduled searches, including some that feed the summary index then you need to wait they kick off and summary index being filled before things shows up in dashboard.