Splunk Search

Entries in F5 Network App not populating data

Explorer

Hi,

I am getting LTM, ASM, APM logs from F5 devices over UDP port 9514 and I have bifurcated the inputs.conf file and I am able to find the sourcetype entries in normal search. Whereas I am unable to see any entries in F5 Network App.

0 Karma
1 Solution

Explorer

I am using the "main" index as of now.

f5_index source=$kpitype$ where1="$where1$" where2="$where2$" is the content present in the app. Should I append for all the macros with index=main in place of `f5index`?

View solution in original post

0 Karma

Explorer

I am using the "main" index as of now.

f5_index source=$kpitype$ where1="$where1$" where2="$where2$" is the content present in the app. Should I append for all the macros with index=main in place of `f5index`?

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

So it does look like it uses an index macro. I must have been looking at the wrong F5 Network app. Then my answer still applies. Go to Settings-->Advanced Configuration-->Search Macros and find f5_index. You should see it define index=. Just change that to main and it should change throughout the entire app.

0 Karma

Explorer

This is working fine. Thank you

0 Karma

SplunkTrust
SplunkTrust

What index is the F5 data stored in? Does your role search that index by default? Either way, the app should specify an index macro, but it only does sourcetypes. If you don't have the index searched by default it won't point to an index to search. You can update this in
Settings-->Advanced Configuration-->Search Macros and then navigate to the F5 app. For each of the macros append index=<your-F5-index> to the beginning of the macro.

0 Karma