topic How do i forward vmware syslog to splunk cloud without using forwarder on esxi operating system in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-i-forward-vmware-syslog-to-splunk-cloud-without-using/m-p/489103#M194040 <P>We have a splunk cloud in our environment and how do i setup a vmware logs to forward to splunk cloud with out installing any Splunk universal forwarder on esxi server? </P> Mon, 09 Mar 2020 14:59:41 GMT meenakande 2020-03-09T14:59:41Z How do i forward vmware syslog to splunk cloud without using forwarder on esxi operating system https://community.splunk.com/t5/Splunk-Search/How-do-i-forward-vmware-syslog-to-splunk-cloud-without-using/m-p/489103#M194040 <P>We have a splunk cloud in our environment and how do i setup a vmware logs to forward to splunk cloud with out installing any Splunk universal forwarder on esxi server? </P> Mon, 09 Mar 2020 14:59:41 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-forward-vmware-syslog-to-splunk-cloud-without-using/m-p/489103#M194040 meenakande 2020-03-09T14:59:41Z Re: How do i forward vmware syslog to splunk cloud without using forwarder on esxi operating system https://community.splunk.com/t5/Splunk-Search/How-do-i-forward-vmware-syslog-to-splunk-cloud-without-using/m-p/489105#M194041 <P>By configuring your esxi hosts to send their syslog to a separate syslog server.<BR /> See: <A href="https://docs.splunk.com/Documentation/AddOns/released/VMW/ESXihosts#Configure_ESXi_hosts_to_send_data">https://docs.splunk.com/Documentation/AddOns/released/VMW/ESXihosts#Configure_ESXi_hosts_to_send_data</A></P> <P>How exactly you setup that syslog server and send the logs from that syslog server to Splunk Cloud is up to you. This can be done in various ways. The classic way of doing it is have the syslog server run rsyslog/syslog-ng which receives the syslog from esxi and write it to files. Then put a UF on the syslog server to read those files and send them to Splunk Cloud.</P> <P>More modern approaches involve solutions that enable you to receive syslog data and send it to HEC. E.g. Splunk Connect for Syslog, or using rsyslog/syslog-ng's built in http output modules (requires recent versions of rsyslog / syslog-ng), or using Ryan Faircloth's omsplunkhec.</P> Mon, 09 Mar 2020 15:10:23 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-forward-vmware-syslog-to-splunk-cloud-without-using/m-p/489105#M194041 FrankVl 2020-03-09T15:10:23Z