F5 Analytics iApp

For those who were receiving the "Stats Response for Splunk xxxxxxxx 0 fail" log messages, I just deployed this iApp today and had the same issue, ran a TCPDUMP to capture the traffic to/from my HEC destination and found the F5 was sending the requests out but getting nothing back, determined from the TCPDUMP that the source address indicated the data was going out the wrong interface, and had to add a route (old traditional LTM Network/Route) to point to my HEC instance out the right interface. That solved this problem for me.

Got the data populating just fine to Splunk, but I do have a question on mapping pools to virtuals. We use an iRule to select a pool to use based on HTTP Host Header on incoming HTTP requests, so there's no pool hard coded on the Virtual Servers. The iAPP resulting data seems to map the pools just fine if they're hard coded on the Virtual Server. Might be a stupid "of course you can't" question, but is there any way to create a dependancy between the Virtual Server and the pools, if they're dynamically selected by an iRule, using an iRule statement such as "pool [HTTP::host]-pool"? Seems Application Componant might somehow play into this, but couldn't find any doc that describes how that mapping attribute is used.