Splunk Search

Entries in F5 Network App not populating data

singriajay
Explorer

Hi,

I am getting LTM, ASM, APM logs from F5 devices over UDP port 9514 and I have bifurcated the inputs.conf file and I am able to find the sourcetype entries in normal search. Whereas I am unable to see any entries in F5 Network App.

0 Karma
1 Solution

singriajay
Explorer

I am using the "main" index as of now.

f5_index source=$kpi_type$ where1="$where1$" where2="$where2$" is the content present in the app. Should I append for all the macros with index=main in place of f5_index?

View solution in original post

0 Karma

singriajay
Explorer

I am using the "main" index as of now.

f5_index source=$kpi_type$ where1="$where1$" where2="$where2$" is the content present in the app. Should I append for all the macros with index=main in place of f5_index?

View solution in original post

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

So it does look like it uses an index macro. I must have been looking at the wrong F5 Network app. Then my answer still applies. Go to Settings-->Advanced Configuration-->Search Macros and find f5_index. You should see it define index=. Just change that to main and it should change throughout the entire app.

0 Karma

singriajay
Explorer

This is working fine. Thank you

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

What index is the F5 data stored in? Does your role search that index by default? Either way, the app should specify an index macro, but it only does sourcetypes. If you don't have the index searched by default it won't point to an index to search. You can update this in
Settings-->Advanced Configuration-->Search Macros and then navigate to the F5 app. For each of the macros append index=<your-F5-index> to the beginning of the macro.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.