For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Alexei_Barabash's avatar
Alexei_Barabash
Icon for Nimbostratus rankNimbostratus
Dec 24, 2017

ASM Logs to Splunk

Hey ,   I was wondering if i can manipulate the logs that are coming from my F5-ASM and goes to Splunk , that it will be displayed differently.   for example i use     I want Splu...
ASM Advanced WAF
security
Simon_Blakely's avatar
Simon_Blakely
Icon for Employee rankEmployee
Dec 24, 2017

Syslog is message-oriented format. The ASM logs are sent as single UDP/TCP records, and the configured CRLF is just a part of the message.

 

You may be able to configure Splunk to split the messages based on the CRLF separator (I think Splunk has a message preprocessor), but that would be a question to ask Splunk.