F5 Analytics iApp

Sorry for the late reply to some of these questions, from the bottom up:

Duplicate values causing conflict: This will not break anything but is related to the fact that all of your mapped applications have a tenant set to "" (blank) which is a static value in the dropdown labeled "Unknown". To correct this ensure you're mapping to some tenant value, you can do this by setting the default tenant within the iApp deployment.

RBAC & 400 messages: When RBAC is used we using the mapping of the tenant + the configured prefixes etc within the RBAC section of the iApp to set the index when sending data to the Splunk HEC. Note, if the indexes are not defined within Splunk or the HEC Token is not allowed to write to those indexes then Splunk will respond with 400 not authorized.

vCMP host requirements: stats are sent via the management port by default. event messages are transformed within TMM and sent via a self-IP. So without a Self-IP you will only get statistics of the vCMP host system.

Latest Cert: wil get back to you on this one

Missing version info: would suggest loading the support 3.7.0 version and opening a bug if it persists.

File Error: have seen this when there are connectivity issues / timeouts when communicating to the splunk server.