Getting F5 data into the data model of enterprise security

[laurent_ripaux]

The F5 logs are sent through the syslog to Splunk. However, the messages are not likely correctly cut out because many fields are populated with the "unknown" value. How can we deal with this? What should be the right configuration to correctly map the log data into the data models? Thank you for your reply. Regards, Laurent Ripaux

[alemarzu]

Hi there @laurent.ripaux

Which app for F5 are you using ?

[tmarlette]

that's a much more complicated question than you think it is.

field extraction is a long process in splunk using regex, and datamodel loading requires even creation, and then tagging. the 'unknown' value is equivalent to 'null', which you may not even want to load into your data model.

for instance, to generically load F5 data into the 'network' data model you'd have to create an event
eventtypes.conf

[f5_event]
search = index=network sourcetype=f5

Then tag it with 'network'. The above example assumes A LOT of other things are in place.
data models usually search for tags

[laurent_ripaux]

Thank you for this answer. We'll have to check the eventtypes.conf in place.