https://community.splunk.com/t5/Splunk-Search/F5-LTM-default-send-string/m-p/31392#M178109 <P>A Splunk customer of mine has set up the Irule to communicate with Splunk and take advantage of the Splunk for f5 Networks. The only thing that is sent udp:514 to splunk is what appears to be just a test message: "default send string". </P> <P>Very novice at BigIP LTM, but know splunk pretty well....any suggestions on what needs to be configured on the LoadBalancer to get more robust logging?</P> <P>BTW: It is not a sourcetype issue. This is the only syslog message we get from the loadbalancer at the moment.</P> Thu, 08 Dec 2011 15:28:38 GMT davecroto 2011-12-08T15:28:38Z https://community.splunk.com/t5/Splunk-Search/F5-LTM-default-send-string/m-p/31392#M178109 <P>A Splunk customer of mine has set up the Irule to communicate with Splunk and take advantage of the Splunk for f5 Networks. The only thing that is sent udp:514 to splunk is what appears to be just a test message: "default send string". </P> <P>Very novice at BigIP LTM, but know splunk pretty well....any suggestions on what needs to be configured on the LoadBalancer to get more robust logging?</P> <P>BTW: It is not a sourcetype issue. This is the only syslog message we get from the loadbalancer at the moment.</P> Thu, 08 Dec 2011 15:28:38 GMT https://community.splunk.com/t5/Splunk-Search/F5-LTM-default-send-string/m-p/31392#M178109 davecroto 2011-12-08T15:28:38Z https://community.splunk.com/t5/Splunk-Search/F5-LTM-default-send-string/m-p/31393#M178110 <P>BTW: It is not a sourcetype issue. This is the only syslog message we get from the loadbalancer at the moment.</P> Thu, 08 Dec 2011 15:51:54 GMT https://community.splunk.com/t5/Splunk-Search/F5-LTM-default-send-string/m-p/31393#M178110 davecroto 2011-12-08T15:51:54Z https://community.splunk.com/t5/Splunk-Search/F5-LTM-default-send-string/m-p/31394#M178111 <P>Can you post a sanitized irule he's using?</P> Thu, 08 Dec 2011 17:56:27 GMT https://community.splunk.com/t5/Splunk-Search/F5-LTM-default-send-string/m-p/31394#M178111 Brian_Osburn 2011-12-08T17:56:27Z https://community.splunk.com/t5/Splunk-Search/F5-LTM-default-send-string/m-p/31395#M178112 <P>This is the step by step guide about setting up the syslog forwarding on the BigIP LTM </P> <P><A href="http://support.f5.com/kb/en-us/solutions/public/8000/200/sol8260.html">http://support.f5.com/kb/en-us/solutions/public/8000/200/sol8260.html</A></P> Fri, 09 Dec 2011 04:03:18 GMT https://community.splunk.com/t5/Splunk-Search/F5-LTM-default-send-string/m-p/31395#M178112 ppang 2011-12-09T04:03:18Z