I have recently installed the F5 Analytics app and it works well with one exception.
For some reason that I am unable to figure out, on the Dashboard, the non-responding hosts section lists every device that is monitored in Splunk (we also monitor Syslog from several hundred network devices).
Any idea how to fix this?
Ideally you should be sending data from the HTTP Event Collector for F5 Devices to a specific index example: f5-default. If you have all of the BIG-IPs going to F5 only indexes you would then update the f5_index macro to index name and that will prevent all hosts from being listed.