We have a similar configuration. There is no indication that any audit log events make it to Splunk even when DEBUG or INFO levels are set. This completely defeats the purpose of audit logs since the ones in Prism Central roll off far too fast to be useful.
We had hoped to have a facility similar to VMWare in AHV that would allow us to see who modified VMs (power off, delete, etc.). However, we’ve found no way to do this. Very disappointing and potentially a show-stopper since we are required by regulations to store and retain these audit records for a minimum of 18 months.
If anyone has had success with this, please let me know.
