My SOC team needs to be able to know the over all health of the F5

have you checked the usual sources?

https://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Setup

https://devcentral.f5.com/s/articles/getting-started-with-splunk-for-f5

https://clouddocs.f5.com/training/community/analytics/html/class1/module2/lab4.html

this has to be a shared effort between the big-ip people, splunk people and the SOC people. get together, feed data into splunk, determine what should be monitored and make that happen.