topic How to get data from F5 Bigip log in Getting Data In

How to get data from F5 Bigip log

ahsaine — Wed, 01 Apr 2026 16:43:23 GMT

Hello,
I need your help please.
I have a log like

F5:WAF "2020-04-08 15:36:21","146632585856347577","",192.121.195.41,443,190.92.12.16,....

anD i want to extract data after the text "F5:WAF":
1st field: the date "2020-04-08 15:36:21"
2nd field: the source ip "192.121.195.41"
3th field: the port "443" ane the 4th the dest ip "190.92.12.16".

Thank you!

Re: How to get data from F5 Bigip log

ragedsparrow — Tue, 09 Jun 2020 21:08:06 GMT

Does your data structure remain the same across messages? If so, I would build the extraction like:

[sourcetype]
EXTRACT-Group = F5\:WAF\s\"(?<date>[^\"]+)\"\,(?:\"[^\"]+\"\,)(?:\"\"\,)(?<src_ip>[^\,]+)\,(?<dest_port>[^\,]+)\,(?<dest_ip>[^\,]+)\,

That being said, there may be something on splunkbase.splunk.com around the F5 WAF data that may be very useful as well.

Re: How to get data from F5 Bigip log

ahsaine — Thu, 11 Jun 2020 09:06:38 GMT

Hi Ragedsparrow,

When i put this request, I get this message:

Re: How to get data from F5 Bigip log

to4kawa — Thu, 11 Jun 2020 11:19:49 GMT

https://docs.splunk.com/Documentation/CIM/4.15.0/User/NetworkTraffic

sample:

| makeresults | eval _raw="F5:WAF \"2020-04-08 15:36:21\",\"146632585856347577\",\"\",192.121.195.41,443,190.92.12.16,..." | rex "F5:WAF\s*\"(?<date>[^,]+)\",[^,]+,[^,]+,(?<src_ip>[^,]+),(?<src_port>[^,]+),(?<dest_ip>[^,]+),"

recommend:

index=yours sourcetype=yours | rex "F5:WAF\s*\"(?<date>[^,]+)\",[^,]+,[^,]+,(?<src_ip>[^,]+),(?<src_port>[^,]+),(?<dest_ip>[^,]+),"

If there is an add-on, you should use it.
I tried to match the name to CIM in case.