If nothing is coming to the syslog facilities on the LEM, the LEM won't have any data to normalize and present no matter what we do.
On the LEM, in that SSH session, go to APPLIANCE. Run DATECONFIG and then press ENTER 4 times without entering anything. Is the LEM's current date/time/timezone correct?
Can you confirm that the Trend system is sending data (send it to another syslog server or use WireShark)?
Support can also run a traffic analysis on the LEM with root access to check if traffic is being received if you open the ticket.