F5 BIG-IP Logs with Cribl Stream

What BIG-IP logs give you

The Cribl Stream docs describe the F5 BIG-IP Source as a push Source that receives telemetry from F5 BIG-IP Telemetry Streaming over the HTTP Event Collector (HEC) protocol. The page classifies the Source plainly: Type is Push, TLS Support is Yes, and Event Breaker Support is No. It supports gzip-compressed inbound data when the Content-Encoding: gzip connection header is set.

The Source accepts structured HEC events at /services/collector/event and raw events at /services/collector/raw, and it can send HEC indexer acknowledgements when the HEC Acks setting is toggled on.

Setting up the source

On the top bar, select Products, then Cribl Stream; under Worker Groups, select a Worker Group. Via QuickConnect, navigate to Routing > QuickConnect, select Add Source, and pick Select Existing or Add New. Via Routes, select Data > Sources, Add Source, then F5 BIG-IP.

In the New Source modal, the General Settings are:

• Input ID: a unique name; cloning the Source adds -CLONE to the original Input ID.
• Description: a description for this Source.
• Address: hostname or IP to listen on for HTTP or HTTPS data. Defaults to 0.0.0.0; supports IPv4 and IPv6.
• Port: the port number to listen on.
• HEC endpoint: keep the default /services/collector. F5 BIG-IP Telemetry Streaming has no custom HEC path setting and always posts structured events to /services/collector/event; the Source also supports /services/collector/raw and indexer acknowledgements.

Under Optional Settings: Allowed indexes lists values to allow in the HEC event index field (wildcards; blank skips validation; can expand validation at the token level). HEC Acks toggles on to enable HEC indexer acknowledgements (default off). Tags filter and group Sources; they aren't added to processed events.

TLS Settings (Server Side): Enabled defaults to off. Toggled on, under Server Certificate select a certificate from the store to auto-fill the paths: Certificate (existing name or Create new), Certificate path (PEM; can reference $ENV_VARS), Private key path (PEM; $ENV_VARS allowed), and Passphrase (decrypts the private key). Under Mutual Authentication (mTLS), Authenticate client (mutual auth) (default off) adds Trusted client CA path ($ENV_VARS allowed), Validate client certificates (default on), and Common name, a regex against the client certificate's CN and SAN fields (default /.*/; clients must match). Minimum TLS version and Maximum TLS version reject clients using TLS versions below or above those thresholds.

Persistent Queue Settings: Enable persistent queue defaults to off; toggled on, the queue buffers and preserves incoming events while a downstream Destination has an outage or backpressure. Mode is Always On (default; writes events to the persistent queue before forwarding) or Smart (engages only on backpressure, such as a blocked downstream Destination at the Buffer size limit). On Cribl-managed Cloud Workers (Enterprise plan), this tab exposes only the Enable persistent queue toggle: PQ runs Always On, capped at 1 GB of uncompressed inbound data per PQ-enabled Source, per Worker Process, not configurable; the remaining settings apply to on-prem and hybrid only. The rest: Buffer size limit (bytes) (default 1MB; range 64KB to 10MB), Commit frequency (default 42), File size limit (default 10 MB; at least the Buffer size limit), Queue size limit (required; default 5 GB; up to 1 TB unless a different Worker Process PQ size limit is set), Queue file path (default $CRIBL_HOME/state/queues, with /<worker-id>/inputs/<input-id> appended), Compression (default None; Gzip available), and Queue-full behavior (Block by default, blocking new data until the queue has capacity; or Drop new data, discarding incoming events and leaving the queue unchanged).

Processing Settings: Fields adds fields to each event with Eval-like functionality, each a Field Name and Value pair (the Value is a JavaScript expression; token- or request-level fields override). Pre-Processing selects a Pipeline or Pack to process data before it goes through Routes.

Auth Tokens: select Add Token. Per token: Authentication method (must be Secret; manually entered tokens aren't supported), Token secret (text secret) (local or global text secret, or create one), Enable token (default on), Allowed indexes (token level; wildcards; blank skips it), Description (the display name), and Fields (Field Name and Value pairs for events referencing this token; request-level fields override).

Advanced Settings: Emit per-token request metrics (default off; per-token <prefix>.http.perToken and summary <prefix>.http.summary request metrics), Show originating IP (default off; client IP and port from PROXY protocol v1 or v2; ignores X-Forwarded-For), Capture request headers (default off; headers go into __headers), CORS allowed origins (wildcards), CORS allowed headers (* allows all), Active request limit (default 256; 0 unlimited; on-prem only), Activity log sample rate (default 100, so every 100th request; minimum 1), Requests-per-socket limit (default 0, unlimited), Socket timeout (seconds) (default 0, indefinite), Request timeout (seconds) (default 0, disabled), Keep-alive timeout (seconds) (default 5; minimum 1, maximum 600), IP allowlist regex (default /.*/; processed unless the denylist also matches), IP denylist regex (default /^$/; takes precedence), and Environment (GitOps branch to enable on; blank enables everywhere).

Under Connected Destinations, select Send to Routes for conditional routing, filtering, and cloning, or QuickConnect for direct connections to Destinations. Then select Save, and Commit & Deploy.

On the F5 side, create a Splunk consumer in F5 BIG-IP Telemetry Streaming, set host and port to the hostname and Port of this Source (https if TLS is enabled), and set passphrase.cipherText to the value of the text secret referenced under Auth Tokens.

What the events look like

The page has no sample event, so its documented shape is internal fields plus transport behavior. The F5 BIG-IP Source page lists four internal fields:

• __headers: request headers, present when Capture request headers is toggled on.
• __hecToken: the HEC token associated with the event.
• __inputId: identifies the Source in the format f5_big_ip:<input-id>.
• __srcIpPort: the source IP address and port.

On the wire, F5 BIG-IP Telemetry Streaming posts telemetry to http(s)://<host>:<port>/services/collector/event with the token in the Authorization: Splunk <token> header; health checks live at /services/collector/health, and with HEC Acks on, acknowledgement requests arrive at /services/collector/ack.

What the docs flag

• No token means unauthorized access: without a configured Auth Token the Source permits unauthorized access; the only supported Authentication method is Secret.
• Smart PQ mode is deprecated on hybrid and on-prem, and affected configurations migrate to Always On automatically in January 2027. The page's checklist: monitor usage, allocate disk space, drain the queues first to avoid orphaned data, and verify routing and filtering in a test environment.
• Version notes: Buffer size limit (bytes) replaced the deprecated event-based Buffer size limit (events) setting as of 4.18.0 (upgraded Worker Groups and Fleets default to 1MB), and in Cribl Stream 4.1 and newer the default PQ Mode is Always on.
• __headers field conflicts: with Capture request headers enabled, some Destinations also read __headers: Webhook, Loki, Microsoft Sentinel, Dynatrace HTTP, and Cortex XSIAM use it for dynamic request headers, Kafka Destinations for message headers, and other Destinations can be affected the same way. Events can leave Cribl Stream with healthy metrics while data is rejected downstream, with no errors, or with TLS certificate and hostname validation failures or errors such as invalid audience. Remove __headers with an Eval Function in a Pipeline (the Rename Function can't operate on field names beginning with __), or toggle Validate server certs off on the Destination only after confirming the conflict is the cause.
• Requests return 404: F5 BIG-IP Telemetry Streaming always posts to /services/collector/event, so keep HEC endpoint at the default /services/collector.
• ACK is disabled: with HEC Acks off, a sender's acknowledgement request gets HTTP 400 and the text ACK is disabled. Toggle HEC Acks on if the sender requires indexer acknowledgements and send the requests to /services/collector/ack with a channel ID, typically the X-Splunk-Request-Channel header or a URL query parameter; the response cites event IDs but doesn't confirm ingestion.

For troubleshooting, the Source modal has a Live Data tab to capture real-time events and a Logs tab for ingestion details, errors, and warnings; the Monitoring page shows data volume and rate.

Frequently asked questions

Is the Cribl Stream F5 BIG-IP Source a push Source?

Yes, the F5 BIG-IP Source is a push Source. It receives telemetry from F5 BIG-IP Telemetry Streaming over the HEC protocol and accepts structured events at /services/collector/event and raw events at /services/collector/raw.

How does F5 BIG-IP Telemetry Streaming authenticate to Cribl Stream?

You add one or more Auth Tokens to the Source, and every token's Authentication method is Secret, referencing a local or global text secret rather than a manually entered token. On the F5 side you set the consumer's passphrase.cipherText to that text secret's value, and with no token configured the Source permits unauthorized access.

What happens if a sender requests an acknowledgement while HEC Acks is off?

Cribl Stream responds with HTTP 400 and the text ACK is disabled. Toggle HEC Acks on if the sender requires indexer acknowledgements, and then send acknowledgement requests to /services/collector/ack with a channel ID; the response cites the event IDs but doesn't confirm ingestion.

Which internal fields does the Cribl Stream F5 BIG-IP Source add to events?

The Source adds __headers, __hecToken, __inputId, and __srcIpPort. __headers appears only when Capture request headers is on, __hecToken holds the HEC token for the event, __inputId identifies the Source as f5_big_ip followed by the input ID, and __srcIpPort holds the source IP address and port.