F5 LTM integration with Splunk

Forums Technical Forums
1

We are looking at integrating our F5 LTM’s into our splunk deployment. I have found several posts but most are over a decade ago. Our main goal is to have logging that can be alerted on within splunk and also see the status of a specific pool/vs from within Splunk. Anyone have any current documents on the best way to achieve this? We currently are using user alerts within the LTM to generate emails for pool/node status and it is not sustainable due to the number of events that are generated.

Thanks,

Joe

2

Jomedusa,

There is and F5 knowledge base articles that summarizes how to send logs to Splunk.

K000163150: Configure BIG-IP high-speed logging to send logs to Splunk - Published Date: Sep 8, 2026

K15316506: How to send logs via high-speed logging to Splunk

In the past I have used the solution ( highspeed logging, log publisher) to send logs to security information and event management (SIEM) systems.