Entries in F5 Network App not populating data

[singriajay]

Hi,

I am getting LTM, ASM, APM logs from F5 devices over UDP port 9514 and I have bifurcated the inputs.conf file and I am able to find the sourcetype entries in normal search. Whereas I am unable to see any entries in F5 Network App.

[singriajay · Accepted solution]

I am using the "main" index as of now.

f5_index source=$kpi_type$ where1="$where1$" where2="$where2$" is the content present in the app. Should I append for all the macros with index=main in place of f5_index?

[mdsnmss]

So it does look like it uses an index macro. I must have been looking at the wrong F5 Network app. Then my answer still applies. Go to Settings-->Advanced Configuration-->Search Macros and find f5_index. You should see it define index=. Just change that to main and it should change throughout the entire app.

[singriajay]

This is working fine. Thank you

[mdsnmss]

What index is the F5 data stored in? Does your role search that index by default? Either way, the app should specify an index macro, but it only does sourcetypes. If you don't have the index searched by default it won't point to an index to search. You can update this in
Settings-->Advanced Configuration-->Search Macros and then navigate to the F5 app. For each of the macros append index=<your-F5-index> to the beginning of the macro.