All Apps and Add-ons

Splunk is breaking ASM huge events

New Member

Hi, my F5 ASM gets some realy huge requests, headers and other fields generating events with more than 64k characters. When that happen, the F5 Big IP breaks the event and when that gets into Splunk it's not recognized as an ASM event, because it's beginning doesn't have the string expected by the application.

Have anyone had the same problem? How do I configure Splunk to get that event correctly parsed and concatenated?

0 Karma

Ultra Champion

hello there,

looked at the add-on and seems like no TRUNCATE value is set, meaning it will truncate events longer than 10000 bytes, default value for this configuration.
try and set TRUNCATE in props.conf under the matching sourcetype stanza in the add-on
create a new local folder in the TA, create props.conf file and add the relevant stanza and a high value for TRUNCATE
read here to learn more:

hope it helps

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...