F5 Analytics iApp
Problem this snippet solves:
Analytics iApp v3.7.0
You can use this fully supported version of the analytics iApp template to marshal statistical and logging data from the BIG-IP system. The iApp takes this data and formats it as a JSON object which is then exported for consumption by data consumers, such as F5 BIG-IQ or applications such as Splunk.
The Analytics iApp allows you to configure several categories of data to be exported. For data consumers like Splunk, the iApp lets you configure the network endpoint to which the data is sent.
Version 3.7.0 of the iApp template is fully supported by F5 and available on downloads.f5.com. We recommend all users upgrade to this version. For more information, see https://support.f5.com/csp/article/K07859431.
While this version of the iApp is nearly identical to the v3.6.13 which was available on this page, the major difference (other than being fully supported) is that ability to gather APM statistics using the iApp has been removed from BIG-IP versions prior to 12.0.
Supported/Tested BIG-IP versions: 11.4.0 - 12.1.2.
Data Sources: LTM, GTM, AFM, ASM, APM, SWG, and iHealth (APM statistics require 12.0 or later)
Data Output Formats: Splunk, F5 Analytics, F5 Risk Engine
Splunk App: https://apps.splunk.com/apps/id/f5
The new deployment guide can be found on F5.com: http://f5.com/pdf/deployment-guides/f5-analytics-dg.pdf
Code :
https://downloads.f5.com/esd/ecc.sv?sw=BIG-IP&pro=iApp_Templates&ver=iApps&container=iApp-Templates
Published May 13, 2016
Version 1.0
Neil_David_HarrNimbostratus
Thanks for the quick response, I will wait for a full 24hrs. Will APM session information be available soon?
adamp_1459great thanks alot
@adamp this can be disabled: Do you want to display advanced options? "Yes"; Information Sources -> Log Stats Responses "No"
- adamp_1459
great iapp however it spams the \var\log\ltm with debug logs,(stats ....) what's the best way to disable the debug notice?
Yep, that would be the case, the iApp works with versions 11.4.0 and higher.
- Raul_Camacho_30
I think that may be the problem. We are on 11.1. Will be upgrading to 12.1 very soon. I will try this install again at that time.
@Richard, yes this will with a GTM only device.
richard_polyakAltocumulus
Hi Ken,
Question will this iApp work on a GTM provisioned device only? Also could you provide me the latest version of the iApp.
Thx -Rich
Philip_Lim_1751Nice screenshots. I see the latest version on the Splunk apps page is Version: 0.9.11. Anyone know if this can be done in Splunk Light or download?
- jspiglerj2rsolves
Tried deploying the iAPP and received the following error
script did not successfully complete: (script did not successfully complete: ("global-settings" unexpected argument while executing "tmsh::modify [string range $args 7 end] " ("modify" arm line 1) invoked from within "switch -exact -- [string range $args 0 5] { create { tmsh::create [string range $args 7 end] } modify { tmsh::modify [string r..." (procedure "iapp::conf" line 14) invoked from within "iapp::conf modify analytics global-settings avrd-interval 300" invoked from within "if {$::basic__format != "F5 Risk Engine" && $::basic__format != "F5 BIG-IQ" && $::basic__logging == "Yes"} { set deviceinfo "non exist" catch {se..." line:5073) while executing "exec /usr/bin/tmsh -c $command" (procedure "tmsh_exe" line 4) invoked from within "tmsh_exe "create sys application service /Common/${::app}-local { template traffic-group traffic-group-local-only variables replace-all-..." invoked from within "if { $createiapp == "Yes" } {
set existing_iapp "non exist" catch {set existing_iapp [tmsh::get_config sys application service /Common/${::app}-..." line:5052)
Anybody else running into this?
