F5 Analytics iApp - Mapping Regex
I'm trying to write a mapping regex for the F5 Analytics iApp (3.7.0). I'm struggling to find a regex combination that works with the naming convention used for the virtual servers. Naming Convention ...vs Example app1.dev.443.vs app1.dev.80.vs app2.443.vs I'm looking for a regex that will pare the virtual server name down to just the app name. Using regex101.com, I was able to verify this regex does what I want. (.*?)\..* When I add it to the mapping table of the iApp, Splunk returns zero results. It seems either the iApp or TMOS itself does not honor the ? as it should. If I omit the ?, the iApp returns everything up to and including the .v of .vs instead of stopping at the first . after the app name. Does anyone have any regex suggestions to just return the app name?
Analytics iAPP
In the process of setting up F5 Analytics. Working on the application mapping and alerts. I have the parameters for the mapping laid out and have successfully defined some. Does anyone have some "standard" type of alerts to get started with. I know each shop is different but trying to determine KPI's to alert on. Any help would be appreciated.
AVR Profile and Remote syslog
Hi all, Just wondering if anyone has managed to use an analytics profile to export the logs/data to an external source, ideally rsyslog? There was a lot of reading about SPLUNK and iApp's and also setting up log publishers/destinations, but I could not find anyone having success logging to a remote syslog server direct from an analytics profile. I think this is possible from the manual of AVR. Any help would be great, Thanks.