Hi Everyone, I have an existing F5 integration using Splunk Add-on for F5 BIG-IP configured to send Syslog and ASM logs to Splunk using the following sourcetypes: f5:bigip:syslog f5:bigip:asm:syslog These data sources are ingesting and parsing correctly. I am now onboarding F5 data into Splunk ITSI and noticed that the ITSI/F5 documentation and associated knowledge objects appear to expect iControl statistics data with sourcetypes such as: f5:bigip:system:statistics:icontrol However, the telemetry data I am receiving is coming through as: f5:bigip:ts:system:statistics:icontrol Since the sourcetype differs, the expected parsing and field extractions are not being applied correctly. I reviewed the TA configuration, including props.conf and transforms.conf, but could not find clear guidance on handling Telemetry Streaming (ts) sourcetypes for ITSI monitoring. Has anyone encountered this issue before? Specifically: Does the F5 ITSI integration officially support Telemetry Streaming sourcetypes (f5:bigip:ts:*)? Is there a recommended approach to map or normalize these sourcetypes to the expected f5:bigip:*:icontrol format? Are there any additional add-ons, CIM mappings, or configuration steps required for Telemetry Streaming data to work with ITSI entity discovery and KPI services? Any documentation, experience, or recommendations would be greatly appreciated. Splunk version:10.2 Splunk ITSI version: 4.21.2 CIM: 6.4.0 Splunk Add-on for F5 BIG-IP: 7.0.0 Thanks in advance for your support.
... View more
