Getting Data In

How to get data from F5 Bigip log

ahsaine
New Member

Hello,
I need your help please.
I have a log like

Spoiler
F5:WAF "2020-04-08 15:36:21","146632585856347577","",192.121.195.41,443,190.92.12.16,....

anD i want to extract data after the text "F5:WAF":
1st field: the date "2020-04-08 15:36:21"
2nd field: the source ip "192.121.195.41"
3th field: the port "443" ane the 4th the dest ip "190.92.12.16".

Thank you!

Labels (1)
0 Karma

ragedsparrow
Contributor

Does your data structure remain the same across messages?  If so, I would build the extraction like:

[sourcetype]
EXTRACT-Group = F5\:WAF\s\"(?<date>[^\"]+)\"\,(?:\"[^\"]+\"\,)(?:\"\"\,)(?<src_ip>[^\,]+)\,(?<dest_port>[^\,]+)\,(?<dest_ip>[^\,]+)\,

 

That being said, there may be something on splunkbase.splunk.com around the F5 WAF data that may be very useful as well.

0 Karma

ahsaine
New Member

Hi Ragedsparrow,

When i put this request, I get this message:

ahsaine_0-1591866267651.png

 

0 Karma

to4kawa
Ultra Champion

https://docs.splunk.com/Documentation/CIM/4.15.0/User/NetworkTraffic

sample:

| makeresults
| eval _raw="F5:WAF \"2020-04-08 15:36:21\",\"146632585856347577\",\"\",192.121.195.41,443,190.92.12.16,..."
| rex "F5:WAF\s*\"(?<date>[^,]+)\",[^,]+,[^,]+,(?<src_ip>[^,]+),(?<src_port>[^,]+),(?<dest_ip>[^,]+),"

recommend:

index=yours sourcetype=yours
| rex "F5:WAF\s*\"(?<date>[^,]+)\",[^,]+,[^,]+,(?<src_ip>[^,]+),(?<src_port>[^,]+),(?<dest_ip>[^,]+),"

If there is an add-on, you should use it.
I tried to match the name to CIM in case.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...