SNAT statistics and iRule for selecting SNAT IP

Just for the sake of completeness: Finally I did not use istats because we have splunk in place here and for this to work I did add the following line to the iRule to log: log local0. "EXCHANGE_2010_SNATPOOL snat_ip=[lindex $static::snpool [eval {expr $packed_address % [llength $static::snpool] }]]" Then in Splunk I use the following search string to create a graph for the distribution of the connections per SNAT IP: index=f5 EXCHANGE_2010_SNATPOOL NOT lindex | timechart count by snat_ip Alternatively this can be used if you need a percentage: index=f5 EXCHANGE_2010_SNATPOOL NOT lindex | top snat_ip