Hi @Mosstrow, for the data that you're reciving on HF through the F5, you don't need to do nothing because it's the F5 that manages the failure redirecting logs to another HF. For the Pull HF, Yes, you could create an alert that start a script to enable the TA on another HF. Only one thing: you can search an eventual failure on Splunk internal logs (_internal) of the Pull HF instead on F5, but it's the same thing. Ciao. Giuseppe ... View more