Installation

Splunk for F5 Access

hikumaran
New Member

Hi Support,

I am running Splunk Enterprise 6.0.2 in Windows Server 2012. i need to get syslogs from F5. i have installed the "Splunk for F5 Access" app. after installed i have rebooted the server. i didn;t see any logs...

Also i have checked this Document
http://answers.splunk.com/answers/110897/splunk-for-f5-access

how do i edit the file(in the web)? where can i do(in the web/command line)?

Please help me

Thanks

Tags (1)
0 Karma

hikumaran
New Member

when i query the log in splunk (compare the log with F5)

source="udp:514" Operation not supported. Multiple*

i see the logs in splunk

how do i configure/get data to Splunk for F5 Access App?

0 Karma

hikumaran
New Member

Yes i am getting several logs.... we have enabled logs from our firewall & F5. so i wanted to separate them. if i run sourcetype=syslog or source="udp:514" i get both device logs... how can i separate the logs?

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Please run the search:

sourcetype=syslog

I want to know if you are getting any syslog data in Splunk.

0 Karma

hikumaran
New Member

yes i add UDP 514 to receive data

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Did you add the UDP data input on port 514 and set the sourcetype to syslog in the Manager UI of the Splunk indexer?

0 Karma

sdaniels
Splunk Employee
Splunk Employee

So you have F5 devices sending syslog to the Splunk server on port 514? Can you verify that the syslog is getting to the actual server using windump or something similar?

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...