All Apps and Add-ons

Splunk Add-on for F5 BIG-IP: Why are we unable to collect LTM traffic and SSL handshakes?

sbattista09
Contributor

After installing the Splunk add on for F5 BigIP, we are having issues with collecting LTM traffic and SSL handshakes. We can see it in the BigIP under val/log/ltm, but it's not sending over to Splunk.

We are getting all other logs that we need however, we are unsure of how to set up the BigIP to send the LTM traffic over.

0 Karma
1 Solution

lding_splunk
Splunk Employee
Splunk Employee

Hi,
For LTM traffics events (mainly http/https), the add-on leverages the iRules/HSL to send relative events to Splunk forwarders.

You need to configure HSL on F5 BIG-IP device side and attach a iRule to your VIPs for this purpose to send https(s) traffics events to Splunk.
Please refer to below guide for detail. Kindly let me know if it works.
http://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Setup
> Configure F5 for HSL
> Configure iRules for LTM

View solution in original post

0 Karma

lding_splunk
Splunk Employee
Splunk Employee

Hi,
For LTM traffics events (mainly http/https), the add-on leverages the iRules/HSL to send relative events to Splunk forwarders.

You need to configure HSL on F5 BIG-IP device side and attach a iRule to your VIPs for this purpose to send https(s) traffics events to Splunk.
Please refer to below guide for detail. Kindly let me know if it works.
http://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Setup
> Configure F5 for HSL
> Configure iRules for LTM

View solution in original post

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, can you file a support ticket so we can see what's going on?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.