I have 5 VMWare hosts sending syslogs to an indexer. 3 servers, vmw010 - vmw012, show up just fine when I do a search using vmw01*. But vmw013 and vmw014 do not show up. 013 and 014 show up individually but will not show all logs. I have checked the timestamp for the last event on each of the two servers and they show current, but will not show up in events.
All 5 VMWare servers are setup the same going to the same index using the same port. Any idea why 3 out of 5 will show up when i do a generic search on all 5, vmw01*?
↧