F5 configguration -Only when i restart the splunk heavy forwarder i am getting the F5 udp data

[Nadhiyaa]

F5 configguration -Only when i restart the splunk heavy forwarder i am getting the F5 udp data

[lakshman239]

Are you using add-on like https://splunkbase.splunk.com/app/2680/
or any suitable add-on from splunk base? https://docs.splunk.com/Documentation/AddOns/latest/F5BIGIP/About

Rather than directly sending syslog to an UDP port in the Heavyforwarder, please setup a syslog-ng or rsyslog on the server [ it can be in the same HF as well] and write the syslogs to file(S) and allow splunk to monitor and ingest them to indexers. This is the recommended way consume syslog and should help troubleshoot any issues (logs coming or not for a given time period) from F5 devices.