Getting Data In

Ingest Esxi logs through vrealize into Splunk via syslog

New Member

Hi All,

I want to ingest ESXi logs through vrealize in Splunk via syslog. Is there any app to get these logs parse correctly. Currently I installed add-on for ESXi and using source-type=vmw-syslog, logs which I am getting is OK but in datamodel some fields such as user, dest, action are appearing value "unknown". Could you please help me.

Thanks in advance

NS

 

Labels (2)
0 Karma

SplunkTrust
SplunkTrust
Datamodels usually insert "unknown" when a source field is absent. You may need to add some aliases to the props.conf file for the vmw-syslog sourcetype so the needed fields can be found by the DM.
---
If this reply helps you, an upvote would be appreciated.
0 Karma