topic Re: F5 Audit Logs in Getting Data In

F5 Audit Logs

syedsalam — Thu, 04 Aug 2016 09:16:22 GMT

Hi,

We have configured F5 int to splunk,What is the search condition to check F5 audit log in to splunk?
Please provide me the suggestion, so we can verify the same.

Regards,
Syed

Re: F5 Audit Logs

inventsekar — Thu, 04 Aug 2016 10:33:53 GMT

please check this sourcetype events - f5:bigip:syslog
if you have any sample events, we can create the splunk query.

Re: F5 Audit Logs

syedsalam — Thu, 04 Aug 2016 11:19:49 GMT

Hi Sekar,

Thanks, Please confirm F5 audit logs come in to f5:bigip:syslog or f5:bigip:1tm:http:irule.

Also share email id, I will send sample events.

Regards,
Syed