Sure, it sounds like you're using a load balancer that uses source NAT (SNAT) so the server side sees a load balancer IP rather than the client IP. If you're using UDP syslog, you can ask your F5 admins to disable SNAT on your VIP. This only works because syslog servers don't send return traffic back to the client (proper routing of return traffic is a key reason SNAT exists).
Another option, again only if you're using UDP, is to configure a stateless VIP. This is described at https://support.f5.com/csp/article/K13675 and it's great for syslog because each event (packet) can be load balanced individually. This type of VIP doesn't even support SNAT so it will keep your client IPs intact. I haven't run this type of config in production yet but I was impressed by the outcome in testing.
If you're using TCP syslog, you might want to stick with the approach discussed here where syslog listens on multiple ports. Each port would send to a specific file to which you can apply an index and sourcetype in your Splunk config. Unfortunately, you would still have a problem with devices that don't include any sort of host identifier in their events.
Hope this helps, good luck!
... View more