https://community.splunk.com/t5/Getting-Data-In/using-Log-Insight-or-VMware-and-NSX-Addon-to-collect-logs-from/m-p/695172#M115467 <P>Hi everyone,</P><P>I'm currently using VMware vRealize Log Insight to collect logs from ESXi hosts, vCenter servers, and NSX components. I then forward these logs to Splunk. However, I've noticed that Log Insight doesn't always parse logs correctly. I'm considering switching to direct integration using the Splunk Add-ons for VMware and NSX.</P><P><STRONG>My Questions</STRONG>:</P><OL><LI><STRONG>Log Volume Reduction</STRONG>: For those who have used Log Insight, what kind of log volume reduction have you achieved through filtering and aggregation before forwarding logs to Splunk?</LI><LI><STRONG>License Usage</STRONG>: How does the Splunk license usage compare between using Log Insight for pre-processing and direct ingestion with Splunk Add-ons?</LI><LI><STRONG>Best Practices</STRONG>: Are there any best practices or tips for optimizing Splunk license usage with either approach?</LI></OL><P><STRONG>Context</STRONG>:</P><UL><LI>Current log volume: Approximately 300 GB per day (raw).</LI><LI>Goals: Improve log parsing accuracy while optimize Splunk license usage.</LI></UL><P>Any insights or experiences would be greatly appreciated!</P><P>Thanks in advance!</P> Sun, 04 Aug 2024 10:45:55 GMT maede_yavari 2024-08-04T10:45:55Z https://community.splunk.com/t5/Getting-Data-In/using-Log-Insight-or-VMware-and-NSX-Addon-to-collect-logs-from/m-p/695172#M115467 <P>Hi everyone,</P><P>I'm currently using VMware vRealize Log Insight to collect logs from ESXi hosts, vCenter servers, and NSX components. I then forward these logs to Splunk. However, I've noticed that Log Insight doesn't always parse logs correctly. I'm considering switching to direct integration using the Splunk Add-ons for VMware and NSX.</P><P><STRONG>My Questions</STRONG>:</P><OL><LI><STRONG>Log Volume Reduction</STRONG>: For those who have used Log Insight, what kind of log volume reduction have you achieved through filtering and aggregation before forwarding logs to Splunk?</LI><LI><STRONG>License Usage</STRONG>: How does the Splunk license usage compare between using Log Insight for pre-processing and direct ingestion with Splunk Add-ons?</LI><LI><STRONG>Best Practices</STRONG>: Are there any best practices or tips for optimizing Splunk license usage with either approach?</LI></OL><P><STRONG>Context</STRONG>:</P><UL><LI>Current log volume: Approximately 300 GB per day (raw).</LI><LI>Goals: Improve log parsing accuracy while optimize Splunk license usage.</LI></UL><P>Any insights or experiences would be greatly appreciated!</P><P>Thanks in advance!</P> Sun, 04 Aug 2024 10:45:55 GMT https://community.splunk.com/t5/Getting-Data-In/using-Log-Insight-or-VMware-and-NSX-Addon-to-collect-logs-from/m-p/695172#M115467 maede_yavari 2024-08-04T10:45:55Z