Splunk Add-on for F5 BIG-IP: Why are we unable to collect LTM traffic and SSL handshakes?

[sbattista09]

After installing the Splunk add on for F5 BigIP, we are having issues with collecting LTM traffic and SSL handshakes. We can see it in the BigIP under val/log/ltm, but it's not sending over to Splunk.

We are getting all other logs that we need however, we are unsure of how to set up the BigIP to send the LTM traffic over.

[lding_splunk · Accepted solution]

Hi,
For LTM traffics events (mainly http/https), the add-on leverages the iRules/HSL to send relative events to Splunk forwarders.

You need to configure HSL on F5 BIG-IP device side and attach a iRule to your VIPs for this purpose to send https(s) traffics events to Splunk.
Please refer to below guide for detail. Kindly let me know if it works.
http://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Setup
> Configure F5 for HSL
> Configure iRules for LTM

[jcoates_splunk]

Hi, can you file a support ticket so we can see what's going on?