For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Basil_Parsley_1's avatar
Basil_Parsley_1
Icon for Nimbostratus rankNimbostratus
Apr 11, 2016

iRule - findstr - find and pull data from HTML payload to Splunk

Guys,   I have been tasked with sorting a HSL log sent from an LTM to Splunk ; basically is a website which customers log in putting in a username / password, subsequent orders require the input o...
application delivery
iRules
LTM
Josiah_39459's avatar
Josiah_39459
Historic F5 Account
Apr 11, 2016

So it sounds like you only want to send the log when "CustomerID" is actually found. So do your 

set resp_custID [findstr [HTTP::payload] "CustomerID"
first and then check 
if { $resp_custID ne "" } {
before logging.

Josiah_39459's avatar
Josiah_39459
Historic F5 Account
Apr 11, 2016
Also if you want to be really elegant and don't want to check EVERY http payload, you can set a flag in HTTP_REQUEST when the appropriate uri is requested and unset it when it's not and then only send your logs if that flag is set.