Splunk for F5 Networks -- Syslog Logs

[vragosta]

All,

Is there a particular sourcetype that should be assigned to the F5 syslog logs? Right now, the logs are being forwarded to Splunk over port 514 and are simply being assigned a sourcetype of "udp:514". Also, I'm not certain the format of the logs is correct. Currently, they look like this:

May 14 16:34:45 10.238.148.22 May 14 16:34:28 AAA-SLDC-LTM3900-2 info logger: [ssl_req][14/May/2013:16:34:28 -0400] 10.238.140.125 TLSv1 AES128-SHA "/xxx/stuff.jsp" 2503

I was expecting a syslog id to appear as part of the logs, such as something like the following:

May 13 13:41:12 AAA-SLDC-LTM3900-2 notice sod[6060]: 010c0019:5: Active

Is it possible all of the logs I am currently receiving simply have no syslog id?

Lastly, if the sourcetype is not being auto assigned, is it possible to assign a sourcetype to a subset of logs destined to a particular source? For example, in addition to the F5 syslog logs, I am also forwarding some firewall logs over this port as well. I obviously don't want to force the sourcetype to be the same for everything destined to port 514.

Thanks!

[bmacias84]

Yes, you can by using your props.conf.

[host::<IPorHOSTname>]

sourcetype=<your source type>

Additional Reading:

• Advancedsourcetypeoverrides
• Configureindex-timefieldextraction
• Addfieldsatsearchtime

Hope this helps or gets you started. Dont forget to vote and accept answers that help.

Cheers,

[bmacias84]

Could you post a couple of samples of both types od syslog data.

[vragosta]

This will not work in this case. There are actually two different sourcetypes originating from the same host. For the F5, I have both F5:iRule:WebAccess logs and standard syslog logs. The F5:iRule:WebAccess logs are being recognized as they should. They are being sent to a unique port and I have overridden the sourcetype. But, how do I indicate the other type of logs from the same host should be classified with a different sourcetype?

Thanks!