Audit logs to splunk

[rams_01]

Hi,

How to configure to send audit logs to splunk?

Thanks!

[mihaic]

Here are some articles : 

https://support.f5.com/csp/article/K13080?sr=42612466

https://support.f5.com/csp/article/K15316506

https://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/ConfigureUDPinputs

https://www.pwndefend.com/2020/07/07/configuring-syslog-integration-with-f5-big-ip/

[rams_01]

Thanks for the informtion,

We already had setup splunk remote servers in F5.  I'm looking how to configure in F5 to just send the audit logs to splunk.

Thanks!

[mihaic]

maybe this is what you are looking for:

https://support.f5.com/csp/article/K56602501

[Omar2]

Hello rams_01

https://support.f5.com/csp/article/K56602501

The above link is to send only audit logs to a remote log server

make sure for the connectivity between F5 and the log server