Splunk Enterprise

F5 configguration -Only when i restart the splunk heavy forwarder i am getting the F5 udp data

Nadhiyaa
Path Finder

F5 configguration -Only when i restart the splunk heavy forwarder i am getting the F5 udp data

Tags (1)
0 Karma

lakshman239
SplunkTrust
SplunkTrust

Are you using add-on like https://splunkbase.splunk.com/app/2680/
or any suitable add-on from splunk base? https://docs.splunk.com/Documentation/AddOns/latest/F5BIGIP/About

Rather than directly sending syslog to an UDP port in the Heavyforwarder, please setup a syslog-ng or rsyslog on the server [ it can be in the same HF as well] and write the syslogs to file(S) and allow splunk to monitor and ingest them to indexers. This is the recommended way consume syslog and should help troubleshoot any issues (logs coming or not for a given time period) from F5 devices.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!