F5 Container Integrations v1.3

Current Page

Application Services Proxy

Cloud Foundry

Kubernetes / OpenShift

Mesos Marathon




Cloud Docs Home > F5 Container Integrations Index


WARNING! You are viewing an outdated documentation set.

View the latest version

How to send statistics to Splunk

The Application Services Proxy (ASP) and BIG-IP device(s) can send data to Splunk for analysis. This tutorial leads you through the steps required to send data from a BIG-IP device and an ASP instance to a Splunk instance.

Before you begin

If you’re sending data from a BIG-IP device to Splunk:

If you’re sending data from the ASP to Splunk:

See also

Application Services Proxy Telemetry Module

Set up Splunk to receive data

  1. Add a new HTTP Event Collector:

    • Click on the Apps gear icon.
    • Go to Settings ‣ Data inputs.
    • Add new HTTP Event Collector.
    • Enter a name for the collector; all other fields can use the default values.
    • Click Next, then Review, then Submit.
    • Record the Token Value Splunk created for your HTTP Event Collector; you’ll configure the analytics providers with this value later.
  2. Enable the HTTP Event Collector:

    • Go to Settings ‣ Data inputs.
    • Click on HTTP Event Collector, then on Global Settings.
    • Click on Enabled.
    • Click Save.
  3. Configure your firewall to allow port 8088 to be open to Splunk.


    The event collector listens on port 8088 and requires HTTPS.

  4. Install the Sankey Splunk App:

    • In the Splunk GUI, click on Apps ‣ Find More Apps.
    • Search for “Sankey”.
    • Click “Install” and enter your splunk.com credentials (this is your actual Splunk account, not the instance login).
    • Accept the license agreement, then click the Login and Install button.
    • Restart Splunk when prompted, then log back in.

Send stats from a BIG-IP device to Splunk

Use an F5 iApps template to enable stats collection on your BIG-IP device and send the data to Splunk. The F5 Analytics iApp is available for download from the F5 DevCentral codeshare.

Deploy the F5 Analytics iApp on the BIG-IP

Download the F5 Analytics iApp from DevCentral, then upload it to the BIG-IP device using the configuration utility.

  1. Select IApps/Templates ‣ Import.
  2. Upload the iApp template (f5.analytics.tmpl).
  3. Select IApps/Application Services ‣ Create.
  4. Choose the f5.analytics template.
  5. Fill in the following fields; unspecified fields should use the default setting.
    • Name - [user defined]
    • Module HSL Streams - No
    • Local System Logging (syslog) - No
    • System SNMP Alerts - No
    • iHealth Snapshot Information - No
    • Your Facility Name - [user defined]
    • Default Tenant - [user defined]
    • Alternative Device Group - [user defined]
    • IP Address or Hostname - [SPLUNK_IP]
    • Port - 8088
    • Protocol - HTTPS
    • API Key - [SPLUNK_TOKEN]
    • Push Interval - 20
    • Mapping Table: 1 - Type=[App Name] From=[Virtual Name] Regex= (.*)_\d  Action=Map
    • Mapping Table: 2 - Type=[Tenant Name] From=[Partition] Regex=(.*) Action=Map
  6. Click Finished.

Send stats from the ASP to Splunk


  1. Edit the Service annotation.

    kubectl edit service <service-name>
  2. Add the “stats” JSON blob.


    • You must escape all quotes, as shown in the example below.
    • Provide the URL and token for your Splunk instance.
    \"stats\": {
      \"url\": \"splunk-url\",
      \"token\": \"splunk-token\",
      \"backend\": \"splunk\"
  3. Verify the change to the Service annotation.

    kubectl get service <service-name>


Add the ASP_DEFAULT_STATS_* labels to the ASP Controller App.

  1. In the Marathon web interface, click on the ASP Controller App.

  2. Click Configuration.

  3. Click Edit.

  4. Click Labels.

  5. Add the stats labels. Provide the URL and token for your Splunk instance.

    "ASP_DEFAULT_STATS_URL": "splunk-url"
    "ASP_DEFAULT_STATS_TOKEN": "splunk-token"
  6. Click Change and deploy configuration.

  7. View the Applications list to verify that the STATS labels appear for all ASP-proxied Apps.