iRule - findstr - find and pull data from HTML payload to Splunk

Guys,

I have been tasked with sorting a HSL log sent from an LTM to Splunk ; basically is a website which customers log in putting in a username / password, subsequent orders require the input of an additional customer ID which turns up in the HTML payload to the server ; we want to log the customer ID whenever it is seen in a relevant payload. I have other data sets sending OK via HSL to Splunk.

The customer Id shows up in the HTML as “customerID12345678” (always 8 digits). Q. How can I get an outcome whereby I get e.g. “Customer ID = 12345678 into the HSL log?

Overall the nascent iRule is looking like the below ..I need to understand what I need to do to line 1 to achieve my aim.

set hsl [HSL::open -proto TCP -pool SPLUNK]

set resp_custID [findstr [HTTP::payload] "CustomerID"

HSL::send $hsl “Customer-ID=” $resp_custID\n"

Q2. The issue with the above is I am going to be creating a bunch of logs with “Customer-ID= blank space ; is there a more elegant approach to this ?

Q3. My logging iRule commands are contained in an overall app iRule – I had been told if a HSL send line referenced a non existant string the whole iRule would grind to a halt – not sure as to the accuracy of this but is there any way HSL code could break an iRule? I am thinking of separating these into logging iRule – app iRule ..

Thanks !!!!