All Apps and Add-ons

Splunk Add-on for F5 BIG-IP: Why are we unable to collect LTM traffic and SSL handshakes?

sbattista09
Contributor

After installing the Splunk add on for F5 BigIP, we are having issues with collecting LTM traffic and SSL handshakes. We can see it in the BigIP under val/log/ltm, but it's not sending over to Splunk.

We are getting all other logs that we need however, we are unsure of how to set up the BigIP to send the LTM traffic over.

0 Karma
1 Solution

lding_splunk
Splunk Employee
Splunk Employee

Hi,
For LTM traffics events (mainly http/https), the add-on leverages the iRules/HSL to send relative events to Splunk forwarders.

You need to configure HSL on F5 BIG-IP device side and attach a iRule to your VIPs for this purpose to send https(s) traffics events to Splunk.
Please refer to below guide for detail. Kindly let me know if it works.
http://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Setup
> Configure F5 for HSL
> Configure iRules for LTM

View solution in original post

0 Karma

lding_splunk
Splunk Employee
Splunk Employee

Hi,
For LTM traffics events (mainly http/https), the add-on leverages the iRules/HSL to send relative events to Splunk forwarders.

You need to configure HSL on F5 BIG-IP device side and attach a iRule to your VIPs for this purpose to send https(s) traffics events to Splunk.
Please refer to below guide for detail. Kindly let me know if it works.
http://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Setup
> Configure F5 for HSL
> Configure iRules for LTM

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, can you file a support ticket so we can see what's going on?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...