Error: Log events missing in Splunk after upgrading to Aria Operations for Logs 8.18.x

Products

• VCF Operations

Issue/Introduction

Introduction 

After upgrading Aria Operations for Logs (formerly vRealize Log Insight) to version 8.18.1 or higher, logs forwarded to Splunk may appear to be missing or not indexed. This occurs due to a change in the event message syntax.

Symptoms

• vCenter log entries are visible in the Aria Operations for Logs "Explore Logs" UI but do not appear in Splunk searches.
• Log forwarder status shows as healthy with no errors in runtime.log.
• Previous Splunk queries or filters targeting "vcenter-server" as the first string in the event message fail to return results.

Environment

• Aria Operations for Logs 8.18.x
• Splunk configured as a Log Forwarding destination

Cause

In version 8.18.1, the log forwarding header format changed. In previous versions (e.g., 8.13), the string "vcenter-server" typically appeared at the beginning of the event line. In version 8.18.x, the timestamp now precedes the identifier, shifting the "vcenter-server" string further into the event message. Splunk filters relying on exact positional matches or specific syntax orders will fail to identify the events.

Resolution

Modify the Splunk filter or query to accommodate the new syntax order.

1. Identify the current Splunk filter used for Aria Operations for Logs data.
2. Update the regex or search criteria to look for "vcenter-server" regardless of its position at the start of the line.
3. Ensure the filter accounts for the timestamp prefix introduced in 8.18.x.
4. Verify that events are now correctly indexed by searching for the vCenter identifier within the message body in Splunk.

Additional Information

• For more information on configuring log forwarding, see Add a Log Forwarding Destination.
• To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.