I have ESX hosts sending logs to rsyslog and then being ingested in Splunk. Originally, I configured to ingest all logs (my linux servers and ESX) into one index called linux. Later, I created new ...
See more...
I have ESX hosts sending logs to rsyslog and then being ingested in Splunk. Originally, I configured to ingest all logs (my linux servers and ESX) into one index called linux. Later, I created new index called "esx" and modified the inputs.conf on my rsyslog server to reflect in stanzas for all the esx hosts and esxvcenter (added index = esx) and restarted Splunkforwarder. However, it looks like, I am getting data in both indexes, linux and esx. I have checked all possible inputs.conf on my rsyslog server but can't find anywhere that directs ESX logs to "linux" index. Any help to troubleshoot the issue would be appreciated.