How I did it - "Visualizing Data with F5 TS and Splunk"
The new Splunk Add-on for F5 BIG-IP includes several objects, (modular inputs, CIM-knowledge, etc.) that work to “normalize” incoming BIG-IP data for use with other Splunk apps, such as Splunk Enterp...
Updated Dec 13, 2022
Version 2.0Greg_Coward
Employee
Joined July 19, 2011
Greg_Coward
Employee
Joined July 19, 2011
jomedusa
Nov 10, 2021Altostratus
We are still not getting AVR information sent to Splunk but we have created specific consumer for stats items we want to display in Splunk. We disabled the system default one as it would send to much traffic to Splunk for what we are wanting to accomplish. One thing I have noticed is that all nodes within the Device Cluster send data at all times to Splunk for the consumers we have created. Is there a way to tell the "Standby" F5 not to send data as it irrelevant to the actual traffic. With both sets of data coming in we have to know which F5 is active to produce our queries/dashboards.
Thanks,
Joe