Better view over loggs from F5 - add-on splunk

Hi Bixo

I'm not an APM engineer myself so I have asked 2 colleagues from Engineering team at F5 who works with APM and the answer was the following:

• Create a pool
  • I think Splunk listen on port 514 for all log details
  • on BIG-IQ you would do this on port 9997
• Create destination
  • Create high speed destination
  • Use high speed log destination to create another destination this time a syslog
• Create Publisher
  • Use syslog destination to create Publisher
• Associate Publisher with access log profile
  • Need to navigate to access log and modify [ kind of following this article here: https://support.f5.com/csp/article/K45423041 ]
• Associate log profile with access profile

The 2nd Engineer pointed this document for you: https://techdocs.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-network-access-12-1-0/10.html

Hope it helps,

Rodrigo

Thank you for the answer. Will give it a try.

Br

//Bixo

Hello, there are also some APM/Splunk templates available:

https://www.f5.com/pdf/solution-center/splunk-templates-for-apm.pdf