Onboarding F5 WAF logs to Splunk

[splunklearner]

I am deployed to new project in splunk. We have logs coming from F5 WAF devices sent to our syslog server. Then we will install UF on our syslog server and forward it to our indexer.

Syslog --- UF --- Indexer

And we have few on premise servers and few are there in AWS EC2 instances.

Can someone explain me more indepth about this project?

There is no HF in our env as of now. So where can we write props.conf and transforms.conf? In indexer or UF?

if we write in indexer, will it work because indexing is already done right? Will props.conf work before indexing the data in indexer?

[ITWhisperer]

Please update your subject to be more descriptive of the question you would like help with. We are volunteers here and would prefer to spend our time working on issues we can help with, so by being more descriptive will allow us to focus our time and energy, and potentially get you a quicker and more accurate response: win/win!

[gcusello]

I @splunklearner ,

you could (not mandatory) put props.conf and transforms.conf on UFs and I hint to do this, also because these files are usually in standard add-ons.

Then you have to put them on Search Heads and on Indexers.

Are you speaking about F5 Waf Security add-on I suppose, did you read the documentation at https://splunkbase.splunk.com/app/2873 ?

Ciao.

Giuseppe