Virtual Server Log Forward to Splunk

You'll have to modify your hsl cmd to avoid outage, there's a known bug & I learned it by experience. Hope it helps.

Also why would you need a TCP, set it as UDP protocol.

when CLIENT_ACCEPTED {
set client_address [IP::client_addr]
set vip [IP::local_addr]
#Set the splunk hsl pool in a variable first
set splunk_pool Splunk_HSL_Pool
#Use that variable to call out in below command
#Bug - https://support.f5.com/csp/article/K14505
set hsl [HSL::open -proto UDP -pool $splunk_pool]
}

And again i see you are creating an HSL open in HTTP RESPONSE which is not required. Just HSL send would be enough.