How I did it - "Visualizing Data with F5 TS and Splunk"

The new Splunk Add-on for F5 BIG-IP includes several objects, (modular inputs, CIM-knowledge, etc.) that work to “normalize” incoming BIG-IP data for use with other Splunk apps, such as Splunk Enterp...
Updated Dec 13, 2022
Version 2.0
application delivery
ASM Advanced WAF
BIG-IP
security
Greg_Coward's avatar
Greg_Coward
Icon for Employee rankEmployee
Apr 06, 2023

Hello,

For AVR, you need to apply a TMSH command to point the AVR configuration to the log publisher.  The specific TMSH command is - modify analytics global-settings { external-logging-publisher /Common/Shared/telemetry_publisher offbox-protocol hsl use-offbox enabled }.  You can find additional information related to this at: https://clouddocs.f5.com/products/extensions/f5-telemetry-streaming/latest/avr.html#modifying-avr-configuration-to-use-the-log-publisher

Hope this helps,

Greg