Getting Data In

how can get syslog from F5 BIGIP with Universal Forwarder

New Member

hi all,

we our splunk enterprise with this configuration:

1 universal forwarder
2 indexers in cluster
1 search head

how can i send traffic to our splunk based on syslog ?

""when we define input in our forwarder with F5 IP address and UDP port 514 we can receive data also the forwarder sends data to indexers and we can see them by our new defined index, but the data is not usable/readable because of mis-configuration in TA/add-on.""
how can i configure add-on in such this structure ?

0 Karma


You can send the syslog traffic to syslog-ng running on the universal forwarder or a Heavy forwarder 514 UDP or TCP if you like even other ports.

Then ingest the logs on the heavy forwarder / UF as you would any other log.

I have found syslog-ng works well for collecting syslog data from various network devices and or appliances. Firewalls, proxies, mail gateways etc. Logs are broken down by hostname in the file structure if you set it up this way.

Data continues to log to syslog-ng when you are doing maintence on Splunk is one advantage.

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...