Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ESXI VMware parser issue? #2166

Closed
RyanKershawWhittle opened this issue Sep 12, 2023 · 2 comments
Closed

ESXI VMware parser issue? #2166

RyanKershawWhittle opened this issue Sep 12, 2023 · 2 comments
Assignees
@mstopa-splunk

Comments

@RyanKershawWhittle
Copy link

Hi is this a sc4s parser error?

image

looks like event splitting is not done correctly? the program -- vpxa -- is replicated two times for one event?
@mstopa-splunk
Copy link
Contributor

Hi @RyanKershawWhittle please check the raw message (https://splunk.github.io/splunk-connect-for-syslog/main/gettingstarted/create-parser/#start-with-a-raw-log-message) and let me know if it's not replicated already there. At first glance I don't see message rewriting in SC4S vsphere config

@mstopa-splunk mstopa-splunk self-assigned this Sep 12, 2023
@RyanKershawWhittle
Copy link
Author

Will close this it looks fine...

Looked like it wasnt splitting up events correctly i.e.

    • Vpxd - - --vpxd--

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mstopa-splunk mstopa-splunk

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@RyanKershawWhittle @mstopa-splunk