Getting Data In

Onboarding F5 WAF logs to Splunk

splunklearner
Communicator

I am deployed to new project in splunk. We have logs coming from F5 WAF devices sent to our syslog server. Then we will install UF on our syslog server and forward it to our indexer.

Syslog --- UF --- Indexer

And we have few on premise servers and few are there in AWS EC2 instances.

Can someone explain me more indepth about this project?

There is no HF in our env as of now. So where can we write props.conf and transforms.conf? In indexer or UF?

if we write in indexer, will it work because indexing is already done right? Will props.conf work before indexing the data in indexer?

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please update your subject to be more descriptive of the question you would like help with. We are volunteers here and would prefer to spend our time working on issues we can help with, so by being more descriptive will allow us to focus our time and energy, and potentially get you a quicker and more accurate response: win/win!

0 Karma

gcusello
SplunkTrust
SplunkTrust

@splunklearner ,

you could (not mandatory) put props.conf and transforms.conf on UFs and I hint to do this, also because these files are usually in standard add-ons.

Then you have to put them on Search Heads and on Indexers.

Are you speaking about F5 Waf Security add-on I suppose, did you read the documentation at https://splunkbase.splunk.com/app/2873 ?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...