Hi! I've followed this guide to forward syslogs from ESX 4.0 U2 (http://www.splunk.com/wiki/Community:VMwareESXSyslog). But I'm not seeing logs appear on my Splunk server. What steps can I take to troubleshoot this? There's no firewall between the ESX hosts and the Splunk server. Splunk is running on a VM, but that shouldn't be a problem, I'm guessing?
I fixed the issue. There was a typo in the Spunk Syslog Wiki - there was an extra : on the end of one of the lines. I've updated the wiki so the command is correct.
I fixed the issue. There was a typo in the Spunk Syslog Wiki - there was an extra : on the end of one of the lines. I've updated the wiki so the command is correct.
Hi @BlightMan,
This extra ":" you mentioned, was it under the "Set the timezone" section of that page http://wiki.splunk.com/Community:VMwareESXSyslog ?
Hi @MuS,
I have to set the timezone as stated in the http://wiki.splunk.com/Community:VMwareESXSyslog doc by using below syntax,
[host::myesx.splunk.com]
TZ=UTC
if I have 8 hosts that are named such as,
cd.esx1.mail.....cd.esx6.mail and cd.svm1.mail...cd.svm3.mail
Can I use the below syntax ?
[host::cd.esx*]
TZ=UTC
[host::cd.svm*]
TZ=UTC
If not, could you please suggest me the most correct way to use the above syntax ?
I haven't done it on host yet. Usually I use sourcetype to do such things - so I cannot not really tell if this will work or not sorry ....
Hi @MuS,
that link takes to the splunk documentation page.
Can you please post the updated link ?
Thanks,
Deven
Link updated 😉
Thanks! @MuS