https://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Setup
I have two issues:
1. In the Splunk docs, the provided log format for DNS logging is prefixed with "<190>". I believe this number represents the facility(local7) and severity(info). The DNS request/response events do not have log_levels associated with and I assume this is the reason. I don't know if the syslog servers or Splunk are doing something wrong.
2. The "answer" field in the DNS response events is a quoted string that looks like this" "test1.f5lab.dhs.gov*. 5 IN A someIpAddress". But when displayed in Splunk, something has replaced the tabs with some kind of ASCll string. Splunk shows the answer field value pair as such: "test1.f5lab.dhs.gov. #0155#011IN#011A#someIpAddress. I'm unsure is this is happening on the syslog server or Splunk side.
