Getting Data In

splunk for f5 Networks - please correct spelling

Communicator

i think you have some spelling mistakes in your transforms

transforms.conf:

[no_memebers_available]

please fix name to be members (also update props.conf entry to match)

[pool_member_src_ip_2]

REGEX = Pool member(.*) monitor satus down
FORMAT = src_ip::$1 

you have an extra space on the line as well STATUS is spelled incorrectly (missing t)

could you follow the common information naming model listed on your website for this extraction?

[pool_member_src_prt]
REGEX = Pool member.*:(.*)monitor
FORMAT = src_prt::$1 
use src_port instead of src_prt

please update all searches that leverage these changes to match

is it possible to change the saved searches to use a macro for the sourcetype? I have a different sourcetype name for the same data and dont want to change my extractions, if there was a macro (ltm_sourcetype => sourcetype=ltm_log ) that i could change to suit my name and add an index if posible that would make it easier for me to update this app to match my requirements.

Explorer

Thank you for bringing this to our attention.

These changes have been applied and I will send Splunk an updated Application for distribution.

With regards to a macro sourcetype: I will need to discuss this with my Splunk contact.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!