Forum Discussion
Kevin_Stewart
Oct 09, 2013Employee
I take it you're looking for a logging function - sending the data to Splunk. The X-Forwarded-For option is for inserting an HTTP header in the request to the application server. You can certainly use the [IP::client_addr] command in mostly any of the client side events (ie. CLIENT_ACCEPTED, HTTP_REQUEST, etc.), and you'll most likely also want to do this with High Speed Logging in lieu of standard "log local" functions:
https://devcentral.f5.com/wiki/iRules.HSL__send.ashx
If you can move up to (at least) 11.1, you can also just build a request logging profile and completely skip the iRules: