how can get syslog from F5 BIGIP with Universal Forwarder

[payamhaddad]

hi all,

we our splunk enterprise with this configuration:

1 universal forwarder
2 indexers in cluster
1 search head
1 SIEM

how can i send traffic to our splunk based on syslog ?

""when we define input in our forwarder with F5 IP address and UDP port 514 we can receive data also the forwarder sends data to indexers and we can see them by our new defined index, but the data is not usable/readable because of mis-configuration in TA/add-on.""
how can i configure add-on in such this structure ?

[plarsenDST]

You can send the syslog traffic to syslog-ng running on the universal forwarder or a Heavy forwarder 514 UDP or TCP if you like even other ports.

Then ingest the logs on the heavy forwarder / UF as you would any other log.

I have found syslog-ng works well for collecting syslog data from various network devices and or appliances. Firewalls, proxies, mail gateways etc. Logs are broken down by hostname in the file structure if you set it up this way.

Data continues to log to syslog-ng when you are doing maintence on Splunk is one advantage.

[p_gurav]

Refer this:

http://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/ConfigureUDPinputs