Hi All,
I have setup F5 iApp to push analytics data to Splunk and could see splunk accepting data from tcp dumps on F5. But I dont see any data in Splunk. I have installed the f5 splunk addon as suggested by the integration guide. Is there a way to check where is the issue.
Verify F5 is using the right HEC token.
Try searching your indexes using 'earliest=-1y latest=+1y' to check for incorrect timestamps.
Check index=_internal for any errors reported by HEC.