We recently installed Splunk v4.3.1 in our Development environment and started sending it Syslogs from our Network Appliances and ESXi server only to discover that some of the events being captured are being parsed into pieces. For example:
19:15 [print__args ] LD____LIBRARY__PATH=/lib:/usr/lib:/opt/vmware/aam/lib:/opt/vmware/vpxa/vpx:
In other instances it appears that a single event is being broken out into 4 or more pieces making the records worthless... Digging a little deeper by clicking on the down arrow shows more of the message and seems to indicate that its treating each line as a seperate record, even then the information displayed is not complete.
Any ideas?
... View more