Installation

Splunk for F5 Access

hikumaran
New Member

Hi Support,

I am running Splunk Enterprise 6.0.2 in Windows Server 2012. i need to get syslogs from F5. i have installed the "Splunk for F5 Access" app. after installed i have rebooted the server. i didn;t see any logs...

Also i have checked this Document
http://answers.splunk.com/answers/110897/splunk-for-f5-access

how do i edit the file(in the web)? where can i do(in the web/command line)?

Please help me

Thanks

Tags (1)
0 Karma

hikumaran
New Member

when i query the log in splunk (compare the log with F5)

source="udp:514" Operation not supported. Multiple*

i see the logs in splunk

how do i configure/get data to Splunk for F5 Access App?

0 Karma

hikumaran
New Member

Yes i am getting several logs.... we have enabled logs from our firewall & F5. so i wanted to separate them. if i run sourcetype=syslog or source="udp:514" i get both device logs... how can i separate the logs?

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Please run the search:

sourcetype=syslog

I want to know if you are getting any syslog data in Splunk.

0 Karma

hikumaran
New Member

yes i add UDP 514 to receive data

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Did you add the UDP data input on port 514 and set the sourcetype to syslog in the Manager UI of the Splunk indexer?

0 Karma

sdaniels
Splunk Employee
Splunk Employee

So you have F5 devices sending syslog to the Splunk server on port 514? Can you verify that the syslog is getting to the actual server using windump or something similar?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...