topic Onboarding F5 WAF logs to Splunk in Getting Data In

Onboarding F5 WAF logs to Splunk

splunklearner — Mon, 04 Nov 2024 15:43:27 GMT

I am deployed to new project in splunk. We have logs coming from F5 WAF devices sent to our syslog server. Then we will install UF on our syslog server and forward it to our indexer.

Syslog --- UF --- Indexer

And we have few on premise servers and few are there in AWS EC2 instances.

Can someone explain me more indepth about this project?

There is no HF in our env as of now. So where can we write props.conf and transforms.conf? In indexer or UF?

if we write in indexer, will it work because indexing is already done right? Will props.conf work before indexing the data in indexer?

Re: Doubt

gcusello — Mon, 04 Nov 2024 13:47:48 GMT

I @splunklearner ,

you could (not mandatory) put props.conf and transforms.conf on UFs and I hint to do this, also because these files are usually in standard add-ons.

Then you have to put them on Search Heads and on Indexers.

Are you speaking about F5 Waf Security add-on I suppose, did you read the documentation at https://splunkbase.splunk.com/app/2873 ?

Ciao.

Giuseppe

Re: Doubt

ITWhisperer — Mon, 04 Nov 2024 14:46:22 GMT

Please update your subject to be more descriptive of the question you would like help with. We are volunteers here and would prefer to spend our time working on issues we can help with, so by being more descriptive will allow us to focus our time and energy, and potentially get you a quicker and more accurate response: win/win!