Splunk Search

Splunk for F5 Networks

bowzom
New Member

Hi all,

I've installed Splunk for F5 Networks application to make some tests on it.
I'm using 11.5 TMOS version and there's something wrong on the regex it uses.

I made some changes on it to match informations needed but it still doesn't work, could you confirm me that it's into /opt/splunk/etc/apps/SplunkforF5Networks/default/transforms.conf every transformations are done ?

Here is the newest regex which include old and new format of syslog events :
/]:\s(........:.):\sPool\s(\S+)\smember\s(\S+)\smonitor\sstatus\s(\S+).\s?[?\s?(?:\S+)?:?\s?(?:\S+)?\s?]?\s+?[\swas\s(\S+)\sfor\s(\S+)/

Thanks in advance for your response 😉

Tags (1)
0 Karma

bowzom
New Member

Thanks for your response.

My problem is not on f5-syslog event but on f5-syslog-eventcode, which is just below the one you saw.

[f5-syslog-eventcode]

REGEX = /]:\s(........:.):\sPool\s(\S+)\smember\s(\S+)\smonitor\sstatus\s(\S+).\s[\s(?:\S+):\s(?:\S+)\s]\s+[\swas\s(\S+)\sfor\s(\S+)/
FORMAT = event_code::$1 ltm_pool::$2 ltm_member::$3 ltm_monitor_status::$4 ltm_prevstatus::$5 ltm_prevstatus_time::$6

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Can you elaborate on the sourcetypes you see within the search part of the F5 app? Looking at the transforms I see that it is doing sourcetype rewriting. Is this app installed on the indexing tier as well, otherwise it is probably not rewriting the sourcetype at index time.

[f5-syslog]
DEST_KEY = MetaData:Sourcetype
REGEX = (01070727:5|01070638:5)
FORMAT = sourcetype::F5:LTM:Syslog

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...