Getting Data In
Highlighted

Ingest Esxi logs through vrealize into Splunk via syslog

New Member

Hi All,

I want to ingest ESXi logs through vrealize in Splunk via syslog. Is there any app to get these logs parse correctly. Currently I installed add-on for ESXi and using source-type=vmw-syslog, logs which I am getting is OK but in datamodel some fields such as user, dest, action are appearing value "unknown". Could you please help me.

Thanks in advance

NS

 

Labels (2)
0 Karma
Highlighted

Re: Ingest Esxi logs through vrealize into Splunk via syslog

SplunkTrust
SplunkTrust
Datamodels usually insert "unknown" when a source field is absent. You may need to add some aliases to the props.conf file for the vmw-syslog sourcetype so the needed fields can be found by the DM.
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.