All Apps and Add-ons

can't read "splunkdestinationip_withrd": no such variable

suarezry
Builder

We are running Splunk v7.2.1 on-premise with F5 LTM v11.5.4. We are seeing some F5 events in splunk (source=bigip.snmptrap and source=bigip.syslog) but we suspect that we are missing a great deal more. The following is logged in the F5:/var/log/ltm:

Dec 18 04:20:19 slot1/my-f5-ltm err scriptd[8262]: 014f0013:3: Script (/Common/analytics-iapp_splunk-send_stats1) generated this Tcl error: (script did not successfully complete: (can't read "splunkdestinationip_withrd": no such variable     while executing "string compare "$splunkdestinationip_withrd" "0" "     ("Splunk" arm line 5)     invoked from within "switch -- $format {                 "Splunk" -                 "F5 Analytics" {                     catch {exec /bin/gzip $filename$i$ext -f}         ..."     ("for" body line 4)     invoked from within "for {set i 0} {$i <= $currentfile} {incr i} {             set curl_response "fail"             set ext ""         switch -- $format {                 ..." line:2619))
Dec 18 04:20:19 slot1/my-f5-ltm err mcpd[8429]: 0107167d:3: Data publisher not found or not implemented when processing request (unknown request), tag (2901).

We do have the correct IP and port listed in "Analytics System Configuration" section and we are seeing some F5 events. Any idea how to fix these errors?

0 Karma
1 Solution

suarezry
Builder

Sorry, this wasn't a splunk issue. I logged a case with F5 and it turned out to be an issue with the iApp. They have released v3.7.2rc5 of the iApp to address this.

View solution in original post

0 Karma

suarezry
Builder

Sorry, this wasn't a splunk issue. I logged a case with F5 and it turned out to be an issue with the iApp. They have released v3.7.2rc5 of the iApp to address this.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@suarezry Is your problem resolved? If so, please accept one of the answers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

prakash007
Builder

@suarezry : did you look at this f5 article related to that error...
https://support.f5.com/csp/article/K17398511

petom
Path Finder

This error is related to iApp running on F5 LTM.
Would it be this one?
https://devcentral.f5.com/codeshare/f5-analytics-iapp

Try to check on F5 site.
I assume that there is missing configuration, which didn't populate splunkdestinationip_withrd variable.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...