topic Re: ESXi Hosts logs are not forwarding to Splunk in Getting Data In

ESXi Hosts logs are not forwarding to Splunk

deepak_negi02 — Wed, 06 Apr 2016 15:00:07 GMT

Hi,

I am trying to get the logs from ESXi hosts to Splunk without using the vmware app. There is no intermediate syslog server on which I can install the forwarder. So I had tried to configure the logs forwarding via esxi hosts advance settings option where we I had provided the IP address of my Splunk server and port tcp1514. Somehow I am still not receiving the logs.

Any suggestion how to get the logs? http://wiki.splunk.com/Community:VMwareESXSyslog ...gone through this link and did the same like mentioned before under advance configuration setting of esxi hosts. Any other approach or what mistake i am doing?

Re: ESXi Hosts logs are not forwarding to Splunk

kserra_splunk — Wed, 06 Apr 2016 20:11:36 GMT

Make sure you have the following

An inputs.conf setup to receive on tcp 1514 on the receiving side
An index to which this data will be sent to on the indexer along with any sourcetype definitions for this data
May want to run a packet capture on port 1514 to make sure the traffic is actually getting to receiver.

Re: ESXi Hosts logs are not forwarding to Splunk

damode — Sun, 22 Oct 2017 23:40:01 GMT

Hi @deepak_negi02, were you able to make this finally work ? I am facing this same issue.
I have configured port 1515 udp on Splunk for esx syslog using the above method.