topic Re: Splunk for F5 Access in Installation

Splunk for F5 Access

hikumaran — Wed, 19 Mar 2014 23:34:33 GMT

Hi Support,

I am running Splunk Enterprise 6.0.2 in Windows Server 2012. i need to get syslogs from F5. i have installed the "Splunk for F5 Access" app. after installed i have rebooted the server. i didn;t see any logs...

Also i have checked this Document
http://answers.splunk.com/answers/110897/splunk-for-f5-access

how do i edit the file(in the web)? where can i do(in the web/command line)?

Please help me

Thanks

Re: Splunk for F5 Access

sdaniels — Thu, 20 Mar 2014 17:43:19 GMT

So you have F5 devices sending syslog to the Splunk server on port 514? Can you verify that the syslog is getting to the actual server using windump or something similar?

Re: Splunk for F5 Access

dmaislin_splunk — Thu, 20 Mar 2014 17:56:55 GMT

Did you add the UDP data input on port 514 and set the sourcetype to syslog in the Manager UI of the Splunk indexer?

Re: Splunk for F5 Access

hikumaran — Thu, 20 Mar 2014 18:04:48 GMT

yes i add UDP 514 to receive data

Re: Splunk for F5 Access

hikumaran — Thu, 20 Mar 2014 18:13:57 GMT

when i query the log in splunk (compare the log with F5)

source="udp:514" Operation not supported. Multiple*

i see the logs in splunk

how do i configure/get data to Splunk for F5 Access App?

Re: Splunk for F5 Access

dmaislin_splunk — Thu, 20 Mar 2014 18:30:14 GMT

Please run the search:

sourcetype=syslog

I want to know if you are getting any syslog data in Splunk.

Re: Splunk for F5 Access

hikumaran — Thu, 20 Mar 2014 19:26:29 GMT

Yes i am getting several logs.... we have enabled logs from our firewall & F5. so i wanted to separate them. if i run sourcetype=syslog or source="udp:514" i get both device logs... how can i separate the logs?