Some sources are empty causing several panels not to load correctly

[rvdvelpe]

Hi,

First of all the app looks very promising!

I bump into the problem that certain sources are empty.
I've looked into the searches and it seems that the following sources are empty:

source=bigip.istats.ssli
source=bigip.objectmodel.cert
source=bigip.avrstats.AVR_STAT_VIP
source=bigip.adm
source=bigip.syslog
source=bigip.log*
source=bigip.snmptrap

I could miss some, but the others seems oké. What could cause that only these sources are empty? How do I troubleshoot this.

iApp version: f5.analytics.v3.7.1rc2
BigIP version: BIG-IP 12.1.1 Build 2.0.204 Hotfix HF2

I followed the deployment guide, except that the index is called "f5_analytics" instead" of "f5-default". I also changed the macro f5_index.

---

Below a overview of the sources:

index=f5_analytics
| stats count(source) as countSource by source
| sort - countSource

source,countSource
"bigip.tmstats.pool_member_stat",42042
"bigip.tmsh.pool_member_status",40796
"bigip.tmstats.pool_stat",31780
"bigip.tmstats.memory_usage_stat",13020
"bigip.objectmodel.virtual.profiles",11060
"bigip.tmstats.rule_stat",8868
"bigip.tmstats.profile_tcp_stat",4984
"bigip.objectmodel.virtual.rules",3192
"bigip.objectmodel.virtual",3108
"bigip.tmsh.virtual_status",3108
"bigip.tmstats.virtual_server_cpu_stat",3108
"bigip.tmstats.virtual_server_stat",3108
"bigip.tmstats.profile_clientssl_stat",3094
"bigip.objectmodel.virtual.pools",2072
"bigip.sessiondb",1904
"bigip.tmstats.profile_serverssl_stat",1736
"bigip.objectmodel.rule.pools",1484
"bigip.tmstats.profile_httpcompression_stat",700
"bigip.tmsh.disk_latency",532
"f5_app_kpi",365
"bigip.tmsh.disk_usage",364
"bigip.tmstats.ifc_stats",350
"bigip.tmstats.profile_udp_stat",280
"bigip.tmstats.interface_stat",252
"bigip.tmstats.profile_connpool_stat",252
"bigip.tmstats.profile_webacceleration_stat",224
"bigip.tmsh.interface_status",140
"bigip.tmstats.cpu_info_stat",112
"bigip.tmstats.profile_ftp_stat",56
"bigip.stats.summary",28
"bigip.tmsh.system_status",28
"bigip.tmstats.disk_info_stat",28
"bigip.tmstats.host_info_stat",28
"bigip.tmstats.ip_stat",28

Best regards,
Ruud.

[evolutionxtinct]

@rvdvelpe,

Were you able to figure this out? I get basically the same SourceTypes as you, but some panels like Application panels are not showing data, when I look at searches they show up as "Undefined" in the search query which makes no sense...

[suarezry]

ssh to the F5 LTM, look at /var/log/ltm to see if there are any errors with the transfer to splunk

[evolutionxtinct]

I'm receiving these errors in the LTM log, but not sure how to resolve.

Jan 15 03:44:03 f5-bigip-n1 info audit_forwarder: audit_forwarder started.
Jan 15 03:44:05 f5-bigip-n1 err scriptd[13853]: 014f0013:3: Script (/Common/Splunk-send_stats) generated this Tcl error: (script did not successfully complete: (01020036:3: The requested RADIUS Server (/Comm
on/Splunk.app) was not found.     while executing "tmsh::get_config auth radius-server /Common/$appname.app/$radius_ihealth"     invoked from within "lindex [tmsh::get_config auth radius-server /Common/$appn
ame.app/$radius_ihealth] 0"     invoked from within "set obj [lindex [tmsh::get_config auth radius-server /Common/$appname.app/$radius_ihealth] 0]" line:41))
Jan 15 03:44:05 f5-bigip-n1 notice mcpd[5856]: 0107167d:5: Data publisher not found or not implemented when processing request (unknown request), tag (2901).