Splunk® Supported Add-ons

Splunk Add-on for F5 BIG-IP

Download manual as PDF

Download topic as PDF

Create new templates for the Splunk Add-on for F5 BIG-IP

Creating a new template is an advanced task and requires you to have knowledge of F5 iControl APIs. For more information about the iControl API, see https://devcentral.f5.com/wiki/icontrol.apireference.ashx on DevCentral, F5's community website.

Create a new template

  1. Go to Configurations > Templates. The Manage Collection Templates page appears listing all templates defined in the app.
  2. Click Add Template to create a new template.
  3. Keep the default Destination App to associate the template with the Splunk Add-on for F5 BIG-IP. The server profile is saved in $SPLUNK_HOME/etc/apps/Your_App/local/f5_bigip_templates.conf.
  4. Provide a template Name. Acceptable characters are a-z, A-Z, 0-9 or "_".
  5. (optional) Enter a Description for the template.
  6. Provide Content. The content must follow the format of the Middle Language Template for F5 BIG-IP iControl APIs. See "Template record format," below.
  7. Click Create.

The templates you create display in the Task list when you create tasks.

Template definition

The template definition provided in this add-on is a flexible configuration script. You can find the template definition in $SPLUNK_HOME/etc/apps/Splunk_TA_f5-bigip/README/f5_bigip_template.spec. In the template definition, "[..]" specifies optional parameters.

Template record format

call <API Name> [against <API Name> [; <API Name>…][ withField RESULT.<Field Name>]][ breakField RESULT.<Field Name>][ interval <interval value>][ --GLOBAL]

call <API Name> API Name is the name of the API. You must specify this parameter in the template.
against <API Name> [; <API Name>…] Specified dependent APIs in this template record. They take the result of "call <API Name>" and use it as a parameter.
withField RESULT.<Field Name> This is used with "against <API Name> [; <API Name>…]". The field returned from "call-API" is used as parameter. If you do not include "withField RESULT.<Field Name>", then all fields of data from call-API are used.
breakField RESULT.<Field Name> This statement breaks the data returned from all APIs in this template record into a list, based on the field specified.
interval <interval value> This is a integer value that specifies how often (in seconds) to run the template. Note that the interval value specified here takes precedence over the interval specified in the server or the task.
--GLOBAL Indicates APIs in this template are global in F5 BIG-IP. If specified, the APIs will be fetched from only one partition, rather than all of the configured partitions on the F5 server.

Template examples

call LocalLB.Pool.get_list

{"with_field": "", "f5_bigip_partition_name": "Common", "break_field": "", "module_interface": "LocalLB.Pool", "get_list": "/Common/Logging-Splunk", "mlt_type": ""}
{"with_field": "", "f5_bigip_partition_name": "Common", "break_field": "", "module_interface": "LocalLB.Pool", "get_list": "/Common/Pool-01", "mlt_type": ""}
{"with_field": "", "f5_bigip_partition_name": "Common", "break_field": "", "module_interface": "LocalLB.Pool", "get_list": "/Common/Pool-02", "mlt_type": ""}
{"with_field": "", "f5_bigip_partition_name": "Common", "break_field": "", "module_interface": "LocalLB.Pool", "get_list": "/Common/Pool-syslog", "mlt_type": ""}

call LocalLB.Pool.get_list against LocalLB.Pool.get_object_status;get_server_ip_to

{"break_field": "", "get_object_status": {"status_description": "The children pool member(s) are down", "availability_status": "AVAILABILITY_STATUS_RED", "enabled_status": "ENABLED_STATUS_ENABLED"}, "get_server_ip_tos": 65535, "with_field": "", "mlt_type": "against", "module_interface": "LocalLB.Pool", "f5_bigip_partition_name": "Common", "get_list": "/Common/Logging-Splunk"}
{"break_field": "", "get_object_status": {"status_description": "The pool is available", "availability_status": "AVAILABILITY_STATUS_GREEN", "enabled_status": "ENABLED_STATUS_ENABLED"}, "get_server_ip_tos": 65535, "with_field": "", "mlt_type": "against", "module_interface": "LocalLB.Pool", "f5_bigip_partition_name": "Common", "get_list": "/Common/Pool-01"}
{"break_field": "", "get_object_status": {"status_description": "The pool is available", "availability_status": "AVAILABILITY_STATUS_GREEN", "enabled_status": "ENABLED_STATUS_ENABLED"}, "get_server_ip_tos": 65535, "with_field": "", "mlt_type": "against", "module_interface": "LocalLB.Pool", "f5_bigip_partition_name": "Common", "get_list": "/Common/Pool-02"}

call LocalLB.Pool.get_all_statistics breakField RESULT.statistics

{"with_field": "", "get_all_statistics": {"statistics": [{"value": {"low": 1260, "high": 0}, "time_stamp": 0, "type": "STATISTIC_SERVER_SIDE_BYTES_IN"}, {"value": {"low": 1749, "high": 0}, "time_stamp": 0, "type": "STATISTIC_SERVER_SIDE_BYTES_OUT"}, {"value": {"low": 18, "high": 0}, "time_stamp": 0, "type": "STATISTIC_SERVER_SIDE_PACKETS_IN"}, {"value": {"low": 15, "high": 0}, "time_stamp": 0, "type": "STATISTIC_SERVER_SIDE_PACKETS_OUT"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_SERVER_SIDE_CURRENT_CONNECTIONS"}, {"value": {"low": 3, "high": 0}, "time_stamp": 0, "type": "STATISTIC_SERVER_SIDE_MAXIMUM_CONNECTIONS"}, {"value": {"low": 3, "high": 0}, "time_stamp": 0, "type": "STATISTIC_SERVER_SIDE_TOTAL_CONNECTIONS"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_PVA_SERVER_SIDE_BYTES_IN"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_PVA_SERVER_SIDE_BYTES_OUT"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_PVA_SERVER_SIDE_PACKETS_IN"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_PVA_SERVER_SIDE_PACKETS_OUT"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_PVA_SERVER_SIDE_CURRENT_CONNECTIONS"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_PVA_SERVER_SIDE_MAXIMUM_CONNECTIONS"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_PVA_SERVER_SIDE_TOTAL_CONNECTIONS"}, {"value": {"low": 3, "high": 0}, "time_stamp": 0, "type": "STATISTIC_TOTAL_REQUESTS"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_CURRENT_SESSIONS"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_TOTAL_PVA_ASSISTED_CONNECTIONS"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_CURRENT_PVA_ASSISTED_CONNECTIONS"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_CONNQUEUE_CONNECTIONS"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_CONNQUEUE_AGE_OLDEST_ENTRY"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_CONNQUEUE_AGE_MAX"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_CONNQUEUE_AGE_MOVING_AVG"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_CONNQUEUE_AGE_EXPONENTIAL_DECAY_MAX"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_CONNQUEUE_SERVICED"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_CONNQUEUE_AGGR_CONNECTIONS"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_CONNQUEUE_AGGR_AGE_OLDEST_ENTRY"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_CONNQUEUE_AGGR_AGE_MAX"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_CONNQUEUE_AGGR_AGE_MOVING_AVG"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_CONNQUEUE_AGGR_AGE_EXPONENTIAL_DECAY_MAX"}, {"value": {"low": 0, "high": 0}, "time_stamp": 0, "type": "STATISTIC_CONNQUEUE_AGGR_SERVICED"}], "pool_name": "/Common/Pool-01"}, "break_field": "statistics", "module_interface": "LocalLB.Pool", "f5_bigip_partition_name": "Common", "mlt_type": "break_field"}

call Management.UserManagement.get_list against Management.UserManagement.get_fullname;get_home_directory withFiled RESULT.name

{"break_field": "", "mlt_type": "against", "with_field": "", "module_interface": "Management.UserManagement", "get_list": {"name": "root", "full_name": "root"}, "f5_bigip_partition_name": "Common"}
{"break_field": "", "mlt_type": "against", "with_field": "", "module_interface": "Management.UserManagement", "get_list": {"name": "admin", "full_name": "Admin User"}, "f5_bigip_partition_name": "Common"}
{"break_field": "", "mlt_type": "against", "with_field": "", "module_interface": "Management.UserManagement", "get_list": {"name": "admin5", "full_name": "admin5"}, "f5_bigip_partition_name": "Common"}
Troubleshoot the Splunk Add-on for F5 BIG-IP
Storage format reference for the Splunk Add-on for F5 BIG-IP

This documentation applies to the following versions of Splunk® Supported Add-ons: released

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters