All Apps and Add-ons

How to modify the inputs for the Splunk Add-On for F5 BIG-IP?

Makinde
New Member

I would like to use the Splunk Add-on for F5 BIG-IP, but I don't want the add-on to query my device for any logs.

I am currently sending the F5 logs to a folder on the Splunk forwarder through Syslog. I created a local folder in the add-on folder and create an inputs.conf file with the following information:

[monitor://C:\logs\F5]
disable = false
sourcetype = F5:bigip:syslog

However, I don't receive any logs. When I make these changes to other apps, I am able to get some changes. I got an error that logs were received for an unconfigured index. I checked my indexes and noticed the F5 Add-on didn't create any indexes automatically. I looked through the default folder, but couldn't find anywhere the Index was specified. I created a new index, but I still am not getting any logs.

Does anyone know what to do so I can use the Add-on, but use a different input method like the one described above?

Thanks,

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

You need to create indexes because that's where your control over performance and security is set; it's bad practice for someone else's app to guess at your needs for those, IMHO.

View solution in original post

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

You need to create indexes because that's where your control over performance and security is set; it's bad practice for someone else's app to guess at your needs for those, IMHO.

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.