All Apps and Add-ons

Basic log parsing setup for VMware

Path Finder

There are a lot of pieces to the VMware App, but I am only interested in parsing logs for now. What pieces do I need to just do basic syslog parsing for vCenter and ESXi? Splunk_TA_esxilogs and Splunk_TA_vcenter?

0 Karma
1 Solution

Path Finder

In answering my own question - this can be accomplished, but the results aren't great.

I used the Splunk_TA_vcenter, Splunk_TA_esxilog, TA-VMW-FieldExtractions, and SA-VMWIndex pieces of the app. Where these are installed and configured will depend on your splunk environment setup, so I won't get into that here.

The esxi logs are okay, I can see web logins and ssh logins, but the fields aren't all extracted for every event so most of the information I'm looking is usually scattered in different fields.

The vcenter logs are less than okay, but after doing a little more reading this may be more of an issue with VMware than anything e.g. 127.0.0.1 for a login event ip address.

View solution in original post

0 Karma

Path Finder

In answering my own question - this can be accomplished, but the results aren't great.

I used the Splunk_TA_vcenter, Splunk_TA_esxilog, TA-VMW-FieldExtractions, and SA-VMWIndex pieces of the app. Where these are installed and configured will depend on your splunk environment setup, so I won't get into that here.

The esxi logs are okay, I can see web logins and ssh logins, but the fields aren't all extracted for every event so most of the information I'm looking is usually scattered in different fields.

The vcenter logs are less than okay, but after doing a little more reading this may be more of an issue with VMware than anything e.g. 127.0.0.1 for a login event ip address.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!