---
title: How F5 Apps Work with Splunk
description: A rundown of what each F5 App actually does to help you decide which app to use with Splunk.
image: https://blog.arcusdata.io/hubfs/120517_1839_WhichF5AppS1.png
---

- [206-247-6655 ](tel:+12062476655)
- [hello@arcusdata.io ](mailto:hello@arcusdata.io)

[![Arcus Data](https://blog.arcusdata.io/hs-fs/hubfs/arcus-header-logo1.png?width=400&height=90&name=arcus-header-logo1.png "Arcus Data")](https://arcusdata.io)

- [Services](https://arcusdata.io/services/)
- [Solutions](https://arcusdata.io/solutions/)
- [Platforms & Applications](https://arcusdata.io/platforms-and-applications/)
- [Company](https://arcusdata.io/about/)
- [Blog](https://blog.arcusdata.io/)
- [Contact](https://arcusdata.io/contact/)

- [Splunk](https://blog.arcusdata.io/topic/splunk)
- [Data](https://blog.arcusdata.io/topic/data)
- [Management](https://blog.arcusdata.io/topic/management)
- [Services](https://blog.arcusdata.io/topic/services)

## [Which F5 App Should I Use with Splunk?](https://blog.arcusdata.io/which-f5-app-should-i-use-with-splunk)

[Dennis Morton](https://blog.arcusdata.io/author/dennis-morton) - January 2019

- [**](http://www.linkedin.com/shareArticle?mini=true&url=https://blog.arcusdata.io/which-f5-app-should-i-use-with-splunk)
- [**](https://www.twitter.com/share?url=https%3A%2F%2Fblog.arcusdata.io%2Fwhich-f5-app-should-i-use-with-splunk)
- [**](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fblog.arcusdata.io%2Fwhich-f5-app-should-i-use-with-splunk)

So you have [Splunk](https://arcusdata.io/services/#sms) and F5 but are thoroughly confused about which F5 App to use because Splunkbase has eight! 

![Eight Splunkbase F5 App](https://blog.arcusdata.io/hubfs/120517_1839_WhichF5AppS1.png)

It’s simpler than it seems, so let’s do a rundown of what each F5 App does.

 

[F5 Query](https://splunkbase.splunk.com/app/2675/)

This App provides a custom Splunk command that allows you to query the status of F5 vServers and Pools. While very cool, it only provides the *capability* to write your own limited set of F5 dashboards.

[F5 WAF Security](https://splunkbase.splunk.com/app/2873/)

This open-source App provides dashboards specific to the F5 WAF (Web Application Firewall). If that is all you need to monitor, then getting this App up and running is very straightforward.

[F5 Security](https://splunkbase.splunk.com/app/815/)

[F5 Networks Remote Access](https://splunkbase.splunk.com/app/1875/)

[F5 Networks LTM](https://splunkbase.splunk.com/app/812/)

[F5 Access Visibility](https://splunkbase.splunk.com/app/814/)

These Apps have been around for quite a while (pre-Splunk 6.x) and while they still work, they suffer from two major issues:

- They get *all* of their data via syslog – which means you are missing the majority of the data that your F5’s can produce.
- Many of their dashboards use Advanced XML, which has been [deprecated](http://docs.splunk.com/Documentation/Splunk/6.6.4/AdvancedDev/Whatsinthismanual) for years. Sure, it still works even in Splunk 7.0 – but if you want to customize them, you’re on your own.

[Splunk Add-on for F5 BIG-IP](https://splunkbase.splunk.com/app/2680/)

This is the latest Splunk supported method for ingesting F5 data. It has many advantages over all the other Apps:

- Via REST calls, it can gather *much* more data than is possible via syslog.
- It *also* gathers and processes all the syslog data that the other Apps do.
- It maps the majority of its data to the Splunk [Common Information Model](http://docs.splunk.com/Documentation/CIM/4.9.1/User/Overview), which means it supports Splunk[Enterprise Security](http://docs.splunk.com/Documentation/ES) OOB.
- This Add-On is required if you want to leverage the [ITSI Load Balancer module](http://docs.splunk.com/Documentation/ITSI/3.0.0/IModules/AboutLoadBalancerModule).

That being said, it has several disadvantages:

- It does not scale well because it gathers its data via REST. I’m not saying that REST does not scale, just that the Splunk/F5 REST does not scale much beyond a small-ish number of F5’s per HF (it also depends on how much each F5 is “doing”).
- It has a limited number of dashboard panels, which means it requires you to develop dashboards (or purchase ITSI).

[F5 Analytics (new)](https://splunkbase.splunk.com/app/3161/)

F5 Analytics is the App you should be running because it has *very* comprehensive coverage of the F5 (full disclosure: I worked on this App):

- It covers the majority of F5 subsystems – Device Groups, Devices, Application Pools, Tenants, Security, Clients, DNS, etc. Just one tab of one dashboard contains a comprehensive URL analysis system!

 

![WhichF5AppS2 - Figure 1 – Web Analytics Example](https://blog.arcusdata.io/hubfs/120517_1839_WhichF5AppS2.png)

*Figure 1 – Web Analytics Example*

- It makes extensive use of drill-downs, allowing you to begin at a high-level and then drill into data that requires investigation.
- All data is collected in a “push” manner from F5 to Splunk. You install an iApp, configure it, and then data is forwarded to Splunk via HTTP Event Collector (HEC). Note that Syslog and SNMP traps are *also* sent via HEC (if so desired).
- The implementation is extensively documented and covers all versions of BigIP from 10.x – 12.x.
- It has a comprehensive built-in KPI system that covers both device-level KPI’s (e.g., CPU, memory, disk) and application-level KPI’s (e.g., pool members, server latency). Think of it as “ITSI-lite”!

 

![WhichF5AppS3 - Figure 2 – Device KPIs Example](https://blog.arcusdata.io/hubfs/120517_1839_WhichF5AppS3.png)

*Figure 2 – Device KPIs Example*

 

![WhichF5AppS4 - Figure 3 – Application KPIs Example](https://blog.arcusdata.io/hubfs/120517_1839_WhichF5AppS4.png)

*Figure 3 – Application KPIs Example*

- It makes extensive use of outlier detection to allow you to spot out-of-normal behavior quickly – both visually (see below) and via the KPI system:

 

![WhichF5AppS5 - Figure 4 – Visual Outlier Example](https://blog.arcusdata.io/hubfs/120517_1839_WhichF5AppS5.png)

*Figure 4 – Visual Outlier Example*

Two caveats to note:

- The 1.0 version of this App is *not* CIM compatible so the data will not show up in Enterprise Security.
- Similarly, it does *not* support the [ITSI Load Balancer module](http://docs.splunk.com/Documentation/ITSI/3.0.0/IModules/AboutLoadBalancerModule).

Conclusion

If you have both Splunk and F5, then you should check out the [F5 Networks – Analytics (new](https://splunkbase.splunk.com/app/3161/)) App, even if you are an ES and/or ITSI shop.

 

---

 

Want more insight like this? Make sure to follow us on [LinkedIn](https://www.linkedin.com/company/18560042/), [Twitter](https://twitter.com/arcusdata) and [Facebook](https://www.facebook.com/ArcusData/)!

 

## Related Articles

- [Splunk](https://blog.arcusdata.io/topic/splunk)
- [Data](https://blog.arcusdata.io/topic/data)
- [Arcus Data](https://blog.arcusdata.io/topic/arcus-data)
- [Data Onboarding](https://blog.arcusdata.io/topic/data-onboarding)
- [Enterprise Security](https://blog.arcusdata.io/topic/enterprise-security)
- [Energy & Utilities](https://blog.arcusdata.io/topic/energy-utilities)
- [How-to](https://blog.arcusdata.io/topic/how-to)
- [OT Security](https://blog.arcusdata.io/topic/ot-security)

## [Onboarding Data Under NERC CIP: Turn Log Hygiene Into Compliance Evidence](https://blog.arcusdata.io/onboarding-data-under-nerc-cip-log-hygiene-compliance-evidence)

[Josh Hritz](https://blog.arcusdata.io/author/josh-hritz) - February 2026

- [Splunk](https://blog.arcusdata.io/topic/splunk)
- [Analytics](https://blog.arcusdata.io/topic/analytics)
- [Data](https://blog.arcusdata.io/topic/data)
- [Arcus Data](https://blog.arcusdata.io/topic/arcus-data)
- [Data Onboarding](https://blog.arcusdata.io/topic/data-onboarding)
- [How-to](https://blog.arcusdata.io/topic/how-to)

## [The Great Eight: props.conf Settings Every Splunk Source Type Needs](https://blog.arcusdata.io/the-great-eight-propsconf-settings-every-splunk-source-type-needs)

[Andrew Leonzo](https://blog.arcusdata.io/author/andrew-leonzo) - October 2025

- [Splunk](https://blog.arcusdata.io/topic/splunk)
- [Analytics](https://blog.arcusdata.io/topic/analytics)
- [Data](https://blog.arcusdata.io/topic/data)
- [Arcus Data](https://blog.arcusdata.io/topic/arcus-data)
- [Data Onboarding](https://blog.arcusdata.io/topic/data-onboarding)
- [How-to](https://blog.arcusdata.io/topic/how-to)

## [Data Onboarding Without the Rework: A Field Checklist for Splunk](https://blog.arcusdata.io/data-onboarding-without-the-rework-splunk-checklist)

[Josh Hritz](https://blog.arcusdata.io/author/josh-hritz) - August 2025

E: [hello@arcusdata.io](mailto:hello@arcusdata.io)

[Linkedin ** ](https://au.linkedin.com/company/arcusdata) [Twitter ** ](https://twitter.com/arcusdata) [Facebook ** ](https://www.facebook.com/ArcusData/)

Copyright 2026

[**](https://blog.arcusdata.io/which-f5-app-should-i-use-with-splunk#) 

![](https://px.ads.linkedin.com/collect/?pid=2558041&fmt=gif)