I need an irule to log HTTP traffic to SPLUNK to capture the originating IP address before it get's NAT'd

I need to capture original IP addresses for HTTP traffic that passes through an F5 LTM then get's NAT'd. I've read several posts but I am not exactly sure where to begin. I am running 10.2.4.