Splunk Log Publisher with iRule HSL

https://clouddocs.f5.com/api/irules/HSL__open.html

HSL::open -publisher <publisher>¶

• Opens and returns a handle for High Speed Logging communication for a log publisher configured in System->Logs->Configuration->Log Publishers. The handle should be used with the HSL::send command to send data to the publisher. introduced in v11.3

When deciding on a publisher for your log messages, bear in mind that HSL::send will not work if the publisher is configured with some formatted destinations like arcsight or splunk. If the log server expects CEF or Splunk formatted messages, the iRule should craft the data the way the server expects it to be formatted and send to a publisher configured with an unformatted destination, such as remote-high-speed-log.