Splunk Add-on for F5 BIG-IP Integration Parsing Issue with Telemetry Streaming Sourcetypes for Splunk ITSI

[desaye]

Hi Everyone,

I have an existing F5 integration using Splunk Add-on for F5 BIG-IP configured to send Syslog and ASM logs to Splunk using the following sourcetypes:

f5:bigip:syslog
f5:bigip:asm:syslog

These data sources are ingesting and parsing correctly.
I am now onboarding F5 data into Splunk ITSI and noticed that the ITSI/F5 documentation and associated knowledge objects appear to expect iControl statistics data with sourcetypes such as:

f5:bigip:system:statistics:icontrol

However, the telemetry data I am receiving is coming through as:

f5:bigip:ts:system:statistics:icontrol

Since the sourcetype differs, the expected parsing and field extractions are not being applied correctly.
I reviewed the TA configuration, including props.conf and transforms.conf, but could not find clear guidance on handling Telemetry Streaming (ts) sourcetypes for ITSI monitoring.
Has anyone encountered this issue before?

Specifically:
Does the F5 ITSI integration officially support Telemetry Streaming sourcetypes (f5:bigip:ts:*)?
Is there a recommended approach to map or normalize these sourcetypes to the expected f5:bigip:*:icontrol format?

Are there any additional add-ons, CIM mappings, or configuration steps required for Telemetry Streaming data to work with ITSI entity discovery and KPI services?
Any documentation, experience, or recommendations would be greatly appreciated.

Splunk version:10.2
Splunk ITSI version: 4.21.2
CIM: 6.4.0
Splunk Add-on for F5 BIG-IP: 7.0.0

Thanks in advance for your support.

[kml_uvce · Accepted solution]

try this

1. Your sourcetype is correct. f5:bigip:ts:system:statistics:icontrol is what the current TA emits — iControl collection now runs over Telemetry Streaming, and all iControl sourcetypes were renamed with the ts: infix. The non-ts names are TA 3.x legacy. The ITSI docs are stale, not your data.
2. ITSI support: no. The TA's ES/ITSI matrix grants ITSI only to the LTM iRule/HSL path; TS system statistics is unsupported. The ITSI Load Balancer module is also deprecated in favour of content packs, and there's no Splunk-supported F5 content pack.
3. Renaming won't fix it. The TS payload is a different schema (system.tmmCpu, virtualServers.*, etc.), not just a different name. Fix the sourcetype and the KPIs still return zero.
4. If you still want the shim — search-time rename in your own app, not an index-time rewrite:

[f5:bigip:ts:system:statistics:icontrol]
rename = f5:bigip:system:statistics:icontrol

Then add FIELDALIAS/EVAL stanzas to bridge field names, and clone the module's entity discovery + KPI base searches (module KOs are read-only).

1. Better path: build entity discovery and service templates directly off the TS schema. Similar effort, no bridge to a deprecated module. Presidio's open-source ITSI Content Pack for F5 (Splunkbase 7418) is a usable skeleton — check its sourcetype assumptions first. Consider routing the stats to a metrics index for cheaper KPIs.

Minor: Splunkbase lists 6.5.1 as the current TA version, so verify the 7.0.0 you noted.

[desaye]

@kml_uvce thank you so much. This is useful information. Let me focus on building entity discovery and service templates directly off the TS schema as you recommended.