ASM v11.6 with Splunk

Question

Hi, i tried to integrated ASM to Splunk, created the log publisher, log destinations and logged profile for ASM and specify the remote server and still i can not see logs on the Splunk Server.&nbsp;
I follow this kb https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm_config_10/asm_sys_mgmt.html1028448&nbsp;
Another test using the irule https://devcentral.f5.com/questions/splunk-for-f5-networks-ltm-v11-irule, this test it works but i need to capture the alerts of attack of ASM, and the username on the request that generate the application, at the splunk i can't see the username of logins of the app.&nbsp;
Any ideas about this implementation?&nbsp;
Regards&nbsp;

joshbecigneul · Answer

Splunk has a F5BIGIP module that you can install that will process logs from ASM. &nbsp;
http://docs.splunk.com/Documentation/AddOns/latest/F5BIGIP/SetupConfigure_F5_Logging_Profiles_for_ASM&nbsp;
I haven't used it yet but will be soon. You configure a custom logging profile to map the ASM log data into a format for splunk to use. &nbsp;

joshbecigneul · Answer

Splunk has a F5BIGIP module that you can install that will process logs from ASM. &nbsp;
http://docs.splunk.com/Documentation/AddOns/latest/F5BIGIP/SetupConfigure_F5_Logging_Profiles_for_ASM&nbsp;
I haven't used it yet but will be soon. You configure a custom logging profile to map the ASM log data into a format for splunk to use. &nbsp;

Forum Discussion

ASM v11.6 with Splunk

2 Replies

Recent Discussions

F5Access | MacOS Sonoma

Active- Active HA setup

syslog server connection

Cannot see floating MAC address outside of ESXi

Rewrite uri translation not working

Related Content

Setting up F5 Telemetry Streaming with Splunk Cloud

How I did it - "Visualizing Data with F5 TS and Splunk"

Splunk syslog loadbalancing

Need iRule for logging all LDAPS requests to HSL Splunk

Getting Started with Splunk for F5