Ingest Esxi logs through vrealize into Splunk via syslog

[NS2017]

Hi All,

I want to ingest ESXi logs through vrealize in Splunk via syslog. Is there any app to get these logs parse correctly. Currently I installed add-on for ESXi and using source-type=vmw-syslog, logs which I am getting is OK but in datamodel some fields such as user, dest, action are appearing value "unknown". Could you please help me.

Thanks in advance

NS

[richgalloway]

Datamodels usually insert "unknown" when a source field is absent. You may need to add some aliases to the props.conf file for the vmw-syslog sourcetype so the needed fields can be found by the DM.