How to ingest data from VMWare ESXI host

[maheshnc]

I want to know what are the ways to ingest the data from ESXI host in Splunk. 

[vjdev]

Hello maheshnc,

If you use HF to receive syslog, it will receive the log, process it, and store it in the indexers. It wouldn't store in HF. 

To archive it,

• Settings → Data Inputs.
• Find the TCP and/or UDP input options under Network data.
• Add new for TCP or UDP.
• Choose the port you want to use.
• Assign a sourcetype.
• Choose or define the index.
• Optionally set host settings.
  

Else, if you want to use UF, set up syslog-ng and store the logs in files and read them using UF by setting up inputs.conf.

Difference:

UF does not do full parsing, routing based on event content. Transformation/filters that require deep processing. It usually has minimal functionality.It is a lightweight component.

HF is a full Splunk Enterprise install that is used as a forwarder. Indexing is typically disabled (or you configure it so it doesn’t index locally) when being used as HF. It can parse, filter, route, transform and mask/anonymize events before forwarding.

Thank you!

[livehybrid]

Whilst this is possible, I would recommend looking at SC4S or syslog-ng approaches first. 

"Splunk recommends the SC4S containerized solution for all customers who are able to adopt it"

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Meett]

Hello @maheshnc You can have look at this document and add-on  : https://docs.splunk.com/Documentation/AddOns/released/VMWesxilogs/Install 

[maheshnc]

Thanks for your inputs. Could you please explain If I can setup my Heavy Forwarder to receive the syslog (instead of syslog ng server with UF installed on it)? if yes, how can I setup my HF to receive the syslog and where will the syslog be stored on HF? also, what will be the difference between using a using a UF and a HF to collect the syslog data.

[livehybrid]

Hi @maheshnc  you "can", but I really would not recommend it. 

Check out https://help.splunk.com/en/splunk-cloud-platform/get-started/splunk-validated-architectures/getting-...for validated archiectures for ingesting syslog into Splunk.

I would recommend looking at SC4S (https://splunk.github.io/splunk-connect-for-syslog/2.30.1/sources/vendor/VMWare/vsphere/) or Rsyslog or Syslog NG combined with Universal Forwarder (UF)/Heavy Forwarder (HF) for your usecase.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing