need help for splunk

i think what you are seeing is the health monitor traffic reaching splunk. if you don't want that you might be find with a simple TCP monitor without sending any data. in this case i don't believe syslog sends a reponse for correct requests so sending anything is not really useful anyway.

did you see anything then "self ip:default send string" on splunk? because in that case your virtual server / pool might not be correctly setup or traffic might be unable to reach your splunk servers.