October 7, 2013

Splunk: Horizon View clients coming up with the same id

Background
Splunk is an excellent tool for collecting log data and generating statistics and graphs based on logs. In a VMware Horizon View environment you by default have no control of the user experience, but there are logs locally on each VDI desktop that provides information on packet loss, latency, and other important things. It is possible to use the Splunk app for VMware PCoIP logs to gather logs from all your VMware View clients into a single console. Even though this app is from 2010 is works fine with Horizon View 5.2.

Problem
When using the universal forwarder from the parent VM, all the VMs created from it will use the name and id of the parent VM.

Solution
Removing the file inputs.conf from the local directory of the parent VM before creating the pool solves the problem.



Splunk gives a very quick overview of all view clients. For a better view of a single client it is best to use the PCoIP Log Viewer.


References
http://blogs.splunk.com/2011/01/03/how-to-splunk-pcoip-log-files-across-an-entire-organization-part-2/
http://apps.splunk.com/app/436/
http://myvirtualcloud.net/?p=1294
http://myvirtualcloud.net/?p=1390
http://mindfluxinc.net/?p=449

1 comment: