iRule - UDP payload/Netflow

I think you need to do something with

UDP::payload

binary scan

• https://devcentral.f5.com/articles/irules-101-17-mapping-protocol-fields-with-the-binary-scan-command
• https://devcentral.f5.com/codeshare?sid=490

You could use something like this to grab the flowset length and do something based on the lenght you have captured from the packet.

when CLIENT_DATA {
    skip packet header and flowset id
    set field_offset 22
    get flowset length
    binary scan [UDP::payload] @${field_offset}S flowset_length
}