Getting Data In

ESXi, Vmware, logs by udp syslog

test_qweqwe
Builder
  1. Installed addon Splunk_TA_esxilogs from https://splunkbase.splunk.com/app/3215/ and moved to /depployment-apps
  2. Configured esxi by https://wiki.splunk.com/Community:VMwareESXSyslog so it send logs to my heavy forwarded which have open port 514.

Logs do not come. Where I missed?

Tags (4)
0 Karma

nickhills
Ultra Champion

The VMware deployment is quite complex:
http://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfiguration

However, assuming you just want to capture the syslog, have you configured a UDP input on your heavy forwarder/indexer?
The TA wont set this up for you.

If you have, then its all the usual suspects to check next, addresses/firewalls/routes etc,

If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...