F5 Analytics iApp

Problem this snippet solves:

Analytics iApp v3.7.0

You can use this fully supported version of the analytics iApp template to marshal statistical and logging data from the BIG-IP system. The iApp takes this data and formats it as a JSON object which is then exported for consumption by data consumers, such as F5 BIG-IQ or applications such as Splunk.

The Analytics iApp allows you to configure several categories of data to be exported. For data consumers like Splunk, the iApp lets you configure the network endpoint to which the data is sent.

Version 3.7.0 of the iApp template is fully supported by F5 and available on downloads.f5.com. We recommend all users upgrade to this version. For more information, see https://support.f5.com/csp/article/K07859431.

While this version of the iApp is nearly identical to the v3.6.13 which was available on this page, the major difference (other than being fully supported) is that ability to gather APM statistics using the iApp has been removed from BIG-IP versions prior to 12.0.

Supported/Tested BIG-IP versions: 11.4.0 - 12.1.2.

Data Sources: LTM, GTM, AFM, ASM, APM, SWG, and iHealth (APM statistics require 12.0 or later)

Data Output Formats: Splunk, F5 Analytics, F5 Risk Engine

Splunk App: https://apps.splunk.com/apps/id/f5

The new deployment guide can be found on F5.com: http://f5.com/pdf/deployment-guides/f5-analytics-dg.pdf

Code :

https://downloads.f5.com/esd/ecc.sv?sw=BIG-IP&pro=iApp_Templates&ver=iApps&container=iApp-Templates
Published May 13, 2016
Version 1.0
analytics
application delivery
application visibility and reporting
f5 iapps
iApps
security
splunk
visibility
  • yamashin55's avatar
    yamashin55
    Icon for Cirrus rankCirrus
    May 20, 2016
    Thank you Analytics iApp. I tried iApp. can not see Analytics. [Error in 'TsidxStats': WHERE clause is not an exact query] Do you know a cause?
  • Ken_Bocchino_49's avatar
    Ken_Bocchino_49
    Historic F5 Account
    May 20, 2016
    @Shingo Yamada can you provide more details on the dashboard and panel displaying this message? I have found that if you're looking at the dashboards immediately after installation of the app you may see some delays and or errors b/c the data models are just starting to be built. You can see the status of the data models under Settings->Data Models and by clicking on the left > to see build status. Also verify you are receiving data into Splunk "index=* source=bigip.* | stats count by index sourcetype source" If you're still having issues feel free to reach out to me via email at KB@F5.com
  • jspiglerj2rsolves's avatar
    jspiglerj2rsolves
    Icon for Nimbostratus rankNimbostratus
    Nov 04, 2016

    Tried deploying the iAPP and received the following error

     

    script did not successfully complete: (script did not successfully complete: ("global-settings" unexpected argument while executing "tmsh::modify [string range $args 7 end] " ("modify" arm line 1) invoked from within "switch -exact -- [string range $args 0 5] { create { tmsh::create [string range $args 7 end] } modify { tmsh::modify [string r..." (procedure "iapp::conf" line 14) invoked from within "iapp::conf modify analytics global-settings avrd-interval 300" invoked from within "if {$::basic__format != "F5 Risk Engine" && $::basic__format != "F5 BIG-IQ" && $::basic__logging == "Yes"} { set deviceinfo "non exist" catch {se..." line:5073) while executing "exec /usr/bin/tmsh -c $command" (procedure "tmsh_exe" line 4) invoked from within "tmsh_exe "create sys application service /Common/${::app}-local { template traffic-group traffic-group-local-only variables replace-all-..." invoked from within "if { $createiapp == "Yes" } {

     

    set existing_iapp "non exist" catch {set existing_iapp [tmsh::get_config sys application service /Common/${::app}-..." line:5052)

     

    Anybody else running into this?

     

  • Philip_Lim_1751's avatar
    Philip_Lim_1751
    Icon for Nimbostratus rankNimbostratus
    Nov 11, 2016

    Nice screenshots. I see the latest version on the Splunk apps page is Version: 0.9.11. Anyone know if this can be done in Splunk Light or download?

     

  • richard_polyak's avatar
    richard_polyak
    Icon for Altocumulus rankAltocumulus
    Dec 07, 2016

    Hi Ken,

     

    Question will this iApp work on a GTM provisioned device only? Also could you provide me the latest version of the iApp.

     

    Thx -Rich

     

  • Raul_Camacho_30's avatar
    Raul_Camacho_30
    Icon for Nimbostratus rankNimbostratus
    Dec 19, 2016

    I think that may be the problem. We are on 11.1. Will be upgrading to 12.1 very soon. I will try this install again at that time.