Splunk for F5 Access guide?

[dooshiant]

Hello,

Using Splunk for F5 Access app and trying send logs from firepass to splunk on port 514.
However, the stats in the F5 Access Dashboard are incomplete. For example I can only see 4 or 5 users in the Connections by User in the last 24 hours chart, but on the firepass, it shows that there was over a 100 connected in the same timeframe..

Is there a configuration guide available for how to configure both the Splunk / F5 Access app and the Firepass device? - I want to verify if my config is correct.

Have tried Splunk support, but they haven't been very helpful and say there is no support for the F5 Access app.

Many thanks!

[MarioM]

there is :

getting started guide

[MarioM]

yes i know firepass is dedicated ssl vpn and the only thing to do is configure remote syslog on firepass to send to splunk (no other choice than udp 514) and set the sourcetype as firepass_log.
After the firepass dashboard is just an example then up to you to build your own.
Splunk is not about app but doing you own reports/dashboard...

[dooshiant]

Hi MarioM,

This guide is for APM which runs on the BigIP platform. Firepass is different and runs on another platform. I have set the sourcetype to firepass_log as stated in the pdf though, but getting only limited stats - not all users / events are being shown..

[gnovak]

I agree, I can't find a link to a manual anywhere.