How to send statistics to Splunk¶

Before you begin¶

• If you don’t already have a Splunk instance, install and configure Splunk.
• Install and configure the Container Connector for your orchestration environment.
  • Deploy the cf-bigip-ctlr in Cloud Foundry
  • Deploy the k8s-bigip-ctlr in Kubernetes
  • Install the marathon-bigip-ctlr in Marathon

tl/dr: Watch the installation video:

Set up Splunk to receive data¶

1. Add a new HTTP Event Collector:

   • Click on the Apps gear icon.
   • Go to Settings ‣ Data inputs.
   • Click on HTTP Event Collector.
   • Click on Global Settings.
   • Click on Enabled.
   • Click Save.
   • Click on New Token.
   • Enter a name for the token, then click Next.
   • On the Input Settings screen, click Create a new index.
   • Name the index, then click Save.
   • Make sure the new index is the Default index.
   • Click Review, then click Submit.
   • Record the Token Value Splunk created for your HTTP Event Collector; you’ll configure the BIG-IP system with this value later.

2. Install the F5 Analytics App.

   • In the Splunk GUI, click on Apps ‣ Find More Apps.
   • Search for “F5 Networks”.
   • Click Install and enter your splunk.com credentials (this is your actual Splunk account, not the instance login).
   • Accept the license agreement, then click the Login and Install button.
   • When the installation is complete, you can view the App, or click Done.

3. Configure your firewall to allow port 8088 to be open to Splunk.

   Important

   The event collector listens on port 8088 and requires HTTPS.

Send stats from a BIG-IP device to Splunk¶

Use the F5 Analytics iApp template to enable stats collection on your BIG-IP device and send the data to Splunk.