we are trying to send journal logs under this location to splunk cloud root@bos-server1:/run/log/journal/112824edd9f56398bab569035733662e# pwd /run/log/journal/112824edd9f56398bab569035733662e ... View more

have you specified the port? syslog.global.loghost=tcp://bos-syslog01.acadian-asset.com after that follow this article to check if the packets are sent: https://kb.vmware.com/s/article/1031186 for example capture 10 packets on the interface vmk0 on the port 1514 and show the payload: tcpdump-uw -i vmk0 -A -c 10 port 1514 ... View more

By configuring your esxi hosts to send their syslog to a separate syslog server. See: https://docs.splunk.com/Documentation/AddOns/released/VMW/ESXihosts#Configure_ESXi_hosts_to_send_data How exactly you setup that syslog server and send the logs from that syslog server to Splunk Cloud is up to you. This can be done in various ways. The classic way of doing it is have the syslog server run rsyslog/syslog-ng which receives the syslog from esxi and write it to files. Then put a UF on the syslog server to read those files and send them to Splunk Cloud. More modern approaches involve solutions that enable you to receive syslog data and send it to HEC. E.g. Splunk Connect for Syslog, or using rsyslog/syslog-ng's built in http output modules (requires recent versions of rsyslog / syslog-ng), or using Ryan Faircloth's omsplunkhec. ... View more