Setting "sourcetype" On Syslog Sent from Viprion

[dave]

Have configured a Viprion to send syslog messages using the standard tmsh command:

modify sys syslog remote-servers add {server{host A.B.C.D remote-port 514}}

and now receiving Viprion logs (via syslog) on the Splunk server, however these logs all have sourcetype=syslog set (as per the data source setup).

So far, Splunk for F5 Networks app shows nothing...

Looking at the savedsearches.conf file that came with the Splunk for F5 Networks app, there are references to ltm_log and gtm_log sourcetypes however neither the transforms.conf nor props.conf has any "sourcetyper" stanza... so how are these sourcetypes assigned?

Am I missing something obvious?

[ericsmith55]

the irule that is included uses "set hsl [HSL::open -proto UDP -pool pool_syslog]" to send the traffic to the splunk indexer. So it seems it is not sending the data to the local ltm log.