Dashboards & Visualizations

F5/Splunk App - LTM dashboard

ebaycmille
New Member

Hello, just curious if anyone has had success getting this to work? Are there any config docs available?

0 Karma

cps42
Explorer

I came upon this thread a bit late, but with the advent of v10 / v11 software, and multimodule Big-IP systems (WAM + ASM + LTM on one system, for example), I've found a different tack on the transforms.conf. You can see some of it in the $SPLUNK_HOME/etc/apps/SplunkforF5/default/ config files.

Each of the modules that runs through AlertD will prepend the log message with a number in this format:


REGEX = (\d{4}[0-9A-Fa-f]{4}:\d+:).

For example, the apm_log regex is


transforms.conf:REGEX = :\s(?:0149[0-9A-Fa-f]{4}:\d+:|0125[0-9A-Fa-f]{4}:\d+:\s[0-9A-Fa-f]{8}:)

Make sure your props.conf file calls those dynamic transforms out, and then you don't have to manually define every LTM on your network in transforms.conf.


TRANSFORMS-f5 = firepass_sourcetyper, asm_sourcetyper, apm_sourcetyper, irule_sourcetyper, PSM_sourcetyper_smtp, PSM_sourcetyper_http, PSM_sourcetyper_ftp, bigip_sourcetyper

0 Karma

MarioM
Motivator

yes if everything is coming on same udp port you can force the sourcetype by host by modifying(or creating) props.conf and transforms.conf in either splunk/etc/system/local,splunk/etc/apps/myapps/local,splunk/etc/apps/SplunkforF5/local:

In transforms.conf for example:

[assign_sourcetype_bigip]
SOURCE_KEY=MetaData:Host
DEST_KEY=_MetaData:Sourcetype
REGEX=^host::(10\.10\.10\.1|10\.10\.10\.2)$
FORMAT=ltm_log

In props.conf:

TRANSFORMS-force-bigip-sourcetype = assign_sourcetype_bigip
0 Karma

charlestips
Explorer

How do you set the manual source type? Everything is coming in on one port, is it possible to set the source type based on the host sending it?

0 Karma

MarioM
Motivator

First make sure your data inputs have the right manual sourcetype:

LTM ltm_log

GTM gtm_log

ASM asm_log

PSM psm_log

Firepass firepass_log

The app has many scheduled searches, including some that feed the summary index then you need to wait they kick off and summary index being filled before things shows up in dashboard.

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...