topic Re: Splunk for F5 Access guide? in Dashboards & Visualizations

Splunk for F5 Access guide?

dooshiant — Wed, 07 Mar 2012 09:36:19 GMT

Hello,

Using Splunk for F5 Access app and trying send logs from firepass to splunk on port 514.
However, the stats in the F5 Access Dashboard are incomplete. For example I can only see 4 or 5 users in the Connections by User in the last 24 hours chart, but on the firepass, it shows that there was over a 100 connected in the same timeframe..

Is there a configuration guide available for how to configure both the Splunk / F5 Access app and the Firepass device? - I want to verify if my config is correct.

Have tried Splunk support, but they haven't been very helpful and say there is no support for the F5 Access app.

Many thanks!

Re: Splunk for F5 Access guide?

gnovak — Wed, 14 Mar 2012 15:17:24 GMT

I agree, I can't find a link to a manual anywhere.

Re: Splunk for F5 Access guide?

MarioM — Wed, 14 Mar 2012 15:42:23 GMT

there is :

getting started guide

Re: Splunk for F5 Access guide?

dooshiant — Fri, 16 Mar 2012 09:55:27 GMT

Hi MarioM,

This guide is for APM which runs on the BigIP platform. Firepass is different and runs on another platform. I have set the sourcetype to firepass_log as stated in the pdf though, but getting only limited stats - not all users / events are being shown..

Re: Splunk for F5 Access guide?

MarioM — Sat, 17 Mar 2012 13:39:44 GMT

yes i know firepass is dedicated ssl vpn and the only thing to do is configure remote syslog on firepass to send to splunk (no other choice than udp 514) and set the sourcetype as firepass_log.
After the firepass dashboard is just an example then up to you to build your own.
Splunk is not about app but doing you own reports/dashboard...