Splunk for F5 BIG-IP LTM logging

[clarkjk]

WHat logs are needed to produce the necessary inputs for the ltm_log source type? Do I need to specify an irule? Where is it documented? If you just set the syslog setting in the LTM all you get are administrative logs not traffice logs that the ltm_log source type can understand

[gundepalli]

Any update on this?,any update on this?

[Brian_Osburn · Accepted solution]

Clark - I don't think the F5 Application supports the LTM line yet. I would set up an iRule to determine what you want to log.

This is one thing I'm going to work on when I'm done my current project.

Brian