Getting Data In

F5 index not properly captured

WilliamF
Engager

How to check if f5 logs are getting into Splunk properly?

Tags (2)

wagnerbianchi
Splunk Employee
Splunk Employee

I am not sure if you are referring to a Splunk for F5 Security, but, I am having some problems related to the extractions done by this app. I followed all the steps available on pdf which came with the app (that once named Creating-a-logging-profile-for-Splunk) and I noticed that when a fields is extracted, it is being extracted field_name=value, not just the field's value. It is being a problem to filter data because the website names into the combo boxes are being extracted the same way either. I wonder if there are additional configs to generate event logs which are not part of that available doc.

Someone having similar problems, I say, related with extractions done by this app?

Thanks for any help.

0 Karma

piebob
Splunk Employee
Splunk Employee

what does 'properly' mean? are you seeing the events in the index? have you tried searching for something you know should be in the events, over all time?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...