For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Basil_Parsley_1's avatar
Basil_Parsley_1
Icon for Nimbostratus rankNimbostratus
Apr 11, 2016

iRule - findstr - find and pull data from HTML payload to Splunk

Guys,   I have been tasked with sorting a HSL log sent from an LTM to Splunk ; basically is a website which customers log in putting in a username / password, subsequent orders require the input o...
application delivery
iRules
LTM
Josiah_39459's avatar
Josiah_39459
Historic F5 Account
Apr 11, 2016

So it sounds like you only want to send the log when "CustomerID" is actually found. So do your 

set resp_custID [findstr [HTTP::payload] "CustomerID"
first and then check 
if { $resp_custID ne "" } {
before logging.

  • Josiah_39459's avatar
    Josiah_39459
    Historic F5 Account
    Apr 11, 2016
    Also if you want to be really elegant and don't want to check EVERY http payload, you can set a flag in HTTP_REQUEST when the appropriate uri is requested and unset it when it's not and then only send your logs if that flag is set.
  • Basil_Parsley_1's avatar
    Basil_Parsley_1
    Icon for Nimbostratus rankNimbostratus
    Apr 11, 2016
    So it sounds like you only want to send the log when "CustomerID --- True ;-) I will look to use the if statement .... My main knowledge gap here is that I do not know how to perform the logic that says - Take the next 8 digits following string and put these in a log. Could I use skip_count ; if so what would be the syntax?
  • Josiah_39459's avatar
    Josiah_39459
    Historic F5 Account
    Apr 11, 2016
    The examples here don't help? https://clouddocs.f5.com/api/irules/findstr.html ---------------------------------------------------------------------------------------- [findstr [HTTP::payload] "" 12 ""]