Hi, my F5 ASM gets some realy huge requests, headers and other fields generating events with more than 64k characters. When that happen, the F5 Big IP breaks the event and when that gets into Splunk it's not recognized as an ASM event, because it's beginning doesn't have the string expected by the application.
Have anyone had the same problem? How do I configure Splunk to get that event correctly parsed and concatenated?
... View more