Getting data into Splunk for F5

nvmurali · ‎12-21-2010

We've configured the F5 ASM device to send syslogs to Splunk via TCP 514. Is there an extra piece of configuration that needs to be done to get Splunk picking up the data?

MarioM · ‎12-21-2010

First your TCP data input sourcetype need to be manual and set to asm_log.

The app has many scheduled searches, including some that feed the summary index then you need to wait they kick off and summary index being filled before things shows up in dashboard.

Getting data into Splunk for F5

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

Join the Conversation

Getting data into Splunk for F5

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A