Getting Data In

how can get syslog from F5 BIGIP with Universal Forwarder

New Member

hi all,

we our splunk enterprise with this configuration:

1 universal forwarder
2 indexers in cluster
1 search head

how can i send traffic to our splunk based on syslog ?

""when we define input in our forwarder with F5 IP address and UDP port 514 we can receive data also the forwarder sends data to indexers and we can see them by our new defined index, but the data is not usable/readable because of mis-configuration in TA/add-on.""
how can i configure add-on in such this structure ?

0 Karma


You can send the syslog traffic to syslog-ng running on the universal forwarder or a Heavy forwarder 514 UDP or TCP if you like even other ports.

Then ingest the logs on the heavy forwarder / UF as you would any other log.

I have found syslog-ng works well for collecting syslog data from various network devices and or appliances. Firewalls, proxies, mail gateways etc. Logs are broken down by hostname in the file structure if you set it up this way.

Data continues to log to syslog-ng when you are doing maintence on Splunk is one advantage.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...