F5 analytics not in splunk

[panduu]

Hi All,

I have setup F5 iApp to push analytics data to Splunk and could see splunk accepting data from tcp dumps on F5. But I dont see any data in Splunk.  I have installed the f5 splunk addon as suggested by the integration guide.  Is there a way to check where is the issue.

[richgalloway]

Verify F5 is using the right HEC token.

Try searching your indexes using 'earliest=-1y latest=+1y' to check for incorrect timestamps.

Check index=_internal for any errors reported by HEC.