This removes some duplicate oids in the f5 definition which I think was messing things up. Now inputs look like:
[{"TrapName":"bigipServiceUp","src_addr":"192.168.0.200","instrumentation.provider":"kentik","provider":"kentik-trap-device","node_name":"/Common/XXX","service_port":"80","TrapOID":".1.3.6.1.4.1.3375.2.4.0.11","collector.name":"ktranslate","message":"Pool /Common/RC_CRM-b-_Pool member /Common/XXX:80 monitor status up. [ /Common/http: up, /Common/http_evo2_F5test: up ] [ was down for 0hr:0min:8sec ]","device_name":"192.168.0.200","eventType":"KSnmpTrap","instrumentation.name":"netflow-events"}]
This removes some duplicate oids in the f5 definition which I think was messing things up. Now inputs look like: