splunk for f5 Networks - please correct spelling

[EricPartington]

i think you have some spelling mistakes in your transforms

transforms.conf:

[no_memebers_available]

please fix name to be members (also update props.conf entry to match)

[pool_member_src_ip_2]

REGEX = Pool member(.*) monitor satus down
FORMAT = src_ip::$1 

you have an extra space on the line as well STATUS is spelled incorrectly (missing t)

could you follow the common information naming model listed on your website for this extraction?

[pool_member_src_prt]
REGEX = Pool member.*:(.*)monitor
FORMAT = src_prt::$1 
use src_port instead of src_prt

please update all searches that leverage these changes to match

is it possible to change the saved searches to use a macro for the sourcetype? I have a different sourcetype name for the same data and dont want to change my extractions, if there was a macro (ltm_sourcetype => sourcetype=ltm_log ) that i could change to suit my name and add an index if posible that would make it easier for me to update this app to match my requirements.

[rblair978]

Thank you for bringing this to our attention.

These changes have been applied and I will send Splunk an updated Application for distribution.

With regards to a macro sourcetype: I will need to discuss this with my Splunk contact.