Cloud Docs Home > F5 Application Services Proxy Index

How to send statistics to Splunk

The Application Services Proxy (ASP) and BIG-IP device(s) can send data to Splunk for analysis. This tutorial leads you through the steps required to send data from a BIG-IP device and an ASP instance to a Splunk instance.

See also

See the Application Services Proxy Telemetry Module for more information about stats collection.

Before you begin

  1. If you don’t already have a Splunk instance, install and configure Splunk.
  2. Install and configure the Application Services Proxy as appropriate for your orchestration environment.

Set up Splunk to receive data

  1. Add a new HTTP Event Collector:

    • Click on the Apps gear icon.
    • Go to Settings ‣ Data inputs.
    • Add new HTTP Event Collector.
    • Enter a name for the collector; all other fields can use the default values.
    • Click Next, then Review, then Submit.
    • Record the Token Value Splunk created for your HTTP Event Collector; you’ll configure the analytics providers with this value later.
  2. Enable the HTTP Event Collector:

    • Go to Settings ‣ Data inputs.
    • Click on HTTP Event Collector, then on Global Settings.
    • Click on Enabled.
    • Click Save.
  3. Configure your firewall to allow port 8088 to be open to Splunk.

    Important

    The event collector listens on port 8088 and requires HTTPS.

  4. Install the Sankey Splunk App:

    • In the Splunk GUI, click on Apps ‣ Find More Apps.
    • Search for “Sankey”.
    • Click “Install” and enter your splunk.com credentials (this is your actual Splunk account, not the instance login).
    • Accept the license agreement, then click the Login and Install button.
    • Restart Splunk when prompted, then log back in.

Send stats from the ASP to Splunk

Kubernetes/OpenShift

  1. Edit the Service and add a “stats” section containing the URL and token for your Splunk instance (must be valid JSON with all quotes escaped, as shown in the example).

    kubectl edit service <service-name> [--namespace=<mynamespace>]
    ...
    \"stats\": {
      \"url\": \"splunk-url\",
      \"token\": \"splunk-token\",
      \"backend\": \"splunk\"
    }
    
  2. Save your changes and exit the editor.

  3. Verify the change to the Service.

    kubectl get service <service-name> [--namespace=<mynamespace>]
    

Marathon

Add the ASP_DEFAULT_STATS_* labels to the ASP Controller App.

  1. In the Marathon web interface, click on the ASP Controller App.

  2. Click Configuration.

  3. Click Edit.

  4. Click Labels.

  5. Add the stats labels containing the URL and token for your Splunk instance.

    "ASP_DEFAULT_STATS_URL": "splunk-url"
    "ASP_DEFAULT_STATS_TOKEN": "splunk-token"
    "ASP_DEFAULT_STATS_BACKEND": "splunk"
    
  6. Click Change and deploy configuration.

  7. View the Applications list to verify that the STATS labels appear for all ASP-proxied Apps.