Are you forwarding Syslog data from each ESXi host to Splunk, or each ESXi host sends Syslog to vCenter, and vCenter sending to Splunk?
1) If it is coming from vCenter, I am guessing the data you are seeing only shows from vCenter host when searching in Splunk, and that is because it is the one sending the data (you would need to transform the data to ensure that it has the correct host for each event). This doc entry would point you in the right direction (do this on the indexer(s)):
http://docs.splunk.com/Documentation/Splunk/5.0/Data/overridedefaulthostassignments
2) If you are trying to send from each ESXi host to Splunk, you might take a look at this article:
http://wiki.splunk.com/Community:VMwareESXSyslog
Pay attention to firewalling that is default in ESXi.
If neither of these is the issue, you might provide a little more detail about the config of the hosts, and the data you are actually seeing inside Splunk.
UPDATE: I should mention that taking direct syslog network feeds is not the ideal way to operate. Splunk generally recommends that you forward syslog data to an intermediate syslog server (syslog-ng for instance), which writes the data to file, which Splunk picks up and forwards to an Indexer.
