I know this is an old thread, but wanted to provide some details as I ran into the same issue.
The Splunk docs provides separate iRules for DNS request logging and DNS response logging.
DNS request logging is configured in DNS > GSLB > iRules. They incorrectly state that you can apply this rule to your Listeners. You can only apply a GSLB iRule to wide IPs.
DNS response logging is configured in DNS > Delivery > iRules. I believe some older versions might list them in Local Traffic > iRules. They incorrectly state you can apply the rule to wide IPs. You can only apply a LTM/Delivery iRule to Listeners.
While the logging does work assuming you apply the rules to the correct objects, the problem I had is ensuring that the request logging rule gets applied to all wide IPs. I want to do logging on the Listeners so I can set it and forget it. Rules configured within DNS > Delivery > iRules support both DNS_REQUEST and DNS_RESPONSE events, but they don't support the whereami, whoami, whereis, and wideip name commands. I simply remove the references to those commands and joined both the request and response rules into a single rule and applied it to my Listeners. I copied an example below.
when DNS_REQUEST {
set client_addr [IP::client_addr]
set dns_server_addr [IP::local_addr]
set question_name [DNS::question name]
set question_class [DNS::question class]
set question_type [DNS::question type]
set dns_len [DNS::len]
set hsl [HSL::open -proto UDP -pool Pool-syslog]
HSL::send $hsl "<190>,f5_irule=Splunk-iRule-DNS_REQUEST,src_ip=$client_addr,dns_server_ip=$dns_server_addr,question_name=$question_name,question_class=$question_class,question_type=$question_type,dns_len=$dns_len"
}
when DNS_RESPONSE {
set client_addr [IP::client_addr]
set dns_server_addr [IP::local_addr]
set question_name [DNS::question name]
set is_wideip [DNS::is_wideip [DNS::question name]]
set answer [join [DNS::answer] ;]
set hsl [HSL::open -proto UDP -pool Pool-syslog]
HSL::send $hsl "<190>,f5_irule=Splunk-iRule-DNS_RESPONSE,src_ip=$client_addr,dns_server_ip=$dns_server_addr,question_name=$question_name,is_wideip=$is_wideip,answer=\"$answer\""
}
