Ingest Esxi logs through vrealize into Splunk via syslog

NS2017 — Mon, 29 Jun 2020 11:13:16 GMT

Hi All,

I want to ingest ESXi logs through vrealize in Splunk via syslog. Is there any app to get these logs parse correctly. Currently I installed add-on for ESXi and using source-type=vmw-syslog, logs which I am getting is OK but in datamodel some fields such as user, dest, action are appearing value "unknown". Could you please help me.

Thanks in advance

Re: Ingest Esxi logs through vrealize into Splunk via syslog

richgalloway — Mon, 29 Jun 2020 14:02:30 GMT

Datamodels usually insert "unknown" when a source field is absent. You may need to add some aliases to the props.conf file for the vmw-syslog sourcetype so the needed fields can be found by the DM.

topic Ingest Esxi logs through vrealize into Splunk via syslog in Getting Data In

Ingest Esxi logs through vrealize into Splunk via syslog

Re: Ingest Esxi logs through vrealize into Splunk via syslog