Log long HTTP URL LTM

Question

I have reviewed several of the other devcentral posts about HTTP HOST length on LTM but I'm still not quite finding the answer I need. 
I am using SSL termination and a sideband call to load balance customer requests to a Splunk server. One of the splunk URLs has a search param that creats a URL ~14,700 chars long! The customer's browser (believe Chrome or FF) handles the call fine when going directly to the server but fails through the F5. 
The F5 appears to be truncating the URL at ~990 chars, which makes sense considering the 1024 bytes limits on irule syslog facility. However, I need to send the full URL to the sideband server. I believe I am capturing the full URL because

log local0. "URL Length: [string length [HTTP::host][HTTP::uri]]

returns a value of 14748. How can I chop up the URL to get the remaining chars and recompile to send on? Is this even possible?
Thx

jg · Answer

Have you configured the BIG-IP system to log to the remote syslog server using the TCP protocol? &nbsp;
See: K13080: Configuring the BIG-IP system to log to a remote syslog server (10.x - 13.x).&nbsp;

harryc · Answer

Having the same issue - trujncates the URL at 2048 when in pass-through mode.&nbsp;

Forum Discussion

Tyler - May 2026 Featured Member

AppWorld Berlin 2026 – iRules Contest Winning Results

One Quick Step to Make your website AI-Agent/MCP Ready with an iRule

Recent Discussions

version 21.1 ACME setup for certificate renewal with Digicert

F5 BIGIP & XC certbot plugin

Use F5 APM as Forward Proxy

Question about source persistence across traffic group

OpenID Connect as Client and Resource server

Related Content

Announcing the first F5 NGINX Commercial Long-Term Support release

The Ingress NGINX Alternative: F5 NGINX Ingress Controller for the Long Term

Forwarding Logs to SIEM Tools via HTTP Proxy for F5 Distributed Cloud Global Log Receiver

Log Http Headers

F5 HTTPS Redirect 2025