Getting Data In

how can get syslog from F5 BIGIP with Universal Forwarder

New Member

hi all,

we our splunk enterprise with this configuration:

1 universal forwarder
2 indexers in cluster
1 search head

how can i send traffic to our splunk based on syslog ?

""when we define input in our forwarder with F5 IP address and UDP port 514 we can receive data also the forwarder sends data to indexers and we can see them by our new defined index, but the data is not usable/readable because of mis-configuration in TA/add-on.""
how can i configure add-on in such this structure ?

0 Karma


You can send the syslog traffic to syslog-ng running on the universal forwarder or a Heavy forwarder 514 UDP or TCP if you like even other ports.

Then ingest the logs on the heavy forwarder / UF as you would any other log.

I have found syslog-ng works well for collecting syslog data from various network devices and or appliances. Firewalls, proxies, mail gateways etc. Logs are broken down by hostname in the file structure if you set it up this way.

Data continues to log to syslog-ng when you are doing maintence on Splunk is one advantage.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...