Hello everyone. I am a newbie to Splunk. I downloaded and installed the free version of Splunk. I just upgraded my VCenter server in VMWare to 5.1 and installed the syslog collector. I am pointing the syslogs to the new Splunk server. How do I configure Splunk to view syslogs from all ESX hosts? I went into Data Inputs and enabled the UDP Data Input on Port 514. If I do a search and look at the UDP data source that I configured, all I see is data from one of my esx hosts. I have 4 esx hosts, all of which are configured the same way in VMWare. I am not sure why Splunk is not monitoring all 4 hosts....only one of them.
What is the best way for me to configure Splunk so I can view the syslogs of ALL 4 of my ESX hosts?
Are you forwarding Syslog data from each ESXi host to Splunk, or each ESXi host sends Syslog to vCenter, and vCenter sending to Splunk?
1) If it is coming from vCenter, I am guessing the data you are seeing only shows from vCenter host when searching in Splunk, and that is because it is the one sending the data (you would need to transform the data to ensure that it has the correct host for each event). This doc entry would point you in the right direction (do this on the indexer(s)):
2) If you are trying to send from each ESXi host to Splunk, you might take a look at this article:
Pay attention to firewalling that is default in ESXi.
If neither of these is the issue, you might provide a little more detail about the config of the hosts, and the data you are actually seeing inside Splunk.
UPDATE: I should mention that taking direct syslog network feeds is not the ideal way to operate. Splunk generally recommends that you forward syslog data to an intermediate syslog server (syslog-ng for instance), which writes the data to file, which Splunk picks up and forwards to an Indexer.