Release history for Splunk Add-on for VMware

These features apply to Splunk Add-on for VMware version 4.0.6, the latest release of the Splunk Add-on for VMware. For compatibility information, see Installation and configuration overview for the Splunk Add-on for VMware in the Splunk Add-on for VMware manual.

New feature or enhancement	Description
Compliance with Splunk advisory	The application has been updated to match the changes in Splunk as described in https://advisory.splunk.com/advisories/SVD-2023-0606. Update the Splunk version based on the advisory to leverage these changes.

Version 4.0.5

New feature or enhancement	Description
Added support for encrypted SSL certificates and updated Axios library to v1.4.0	Added support for Encrypted SSL certificates on Splunk version 8.2.x and 9.0.x. Upgraded Axios library version to 1.4.0 to fix vulnerabilities related to Inefficient Regular Expression Complexity and Server-Side Request Forgery (SSRF).

Version 4.0.4

These features apply to Splunk Add-on for VMware version 4.0.4. For compatibility information, see Installation and configuration overview for the Splunk Add-on for VMware in the Splunk Add-on.

New feature or enhancement	Description
Some minor bug fixes	Updated key for syslog stanza
Added triggers stanza for custom configuration files	To avoid unnecessary restarts of the Splunk platform, updated app.conf file with a [triggers] stanza and a reload setting for custom configuration file

Version 4.0.3

These features apply to Splunk Add-on for VMware version 4.0.3. For compatibility information, see Installation and configuration overview for the Splunk Add-on for VMware in the Splunk Add-on.

Self-Service Installation Compatibility

The Splunk Add-on for VMware is now available for self-service installation in cloud environments. The following packages have been removed from the add-on package and published as individual Splunkbase add-ons to support self-service installation in cloud environments:

Package	Splunkbase Add-on	Version
SA-VMWIndex	Splunk Add-on for VMware Indexes	4.0.3
TA-VMW-FieldExtractions	Splunk Add-on for VMware Extractions	4.0.3
Splunk_TA_esxilogs	Splunk Add-on for VMware ESXi Logs	4.2.1
Splunk_TA_vcenter	Splunk Add-on for vCenter Logs	4.2.1

jQuery 3.5 Compatibility

The Splunk Add-on for VMware is now updated to use jQuery v3.5.0. The add-on uses jQuery v3.5 in the Splunk version 8.2 or later. This makes the add-on more secure by fixing known cross-site scripting (XSS) related vulnerabilities as well as vulnerabilities created by object prototype pollution.

Version 4.0.2

This version of the Splunk Add-on for VMware doesn't contain biased terms such as master, slave, blacklist, and whitelist have been replaced with appropriate non-biased terms. The occurrences of biased terms that are Splunk platform references or present in the third-party library have not been removed. The following table contains the parameters from the ta_vmware_collection.conf file present in the Splunk_TA_vmware package that has been renamed to remove biased language:

Parameter name in Splunk Add-on for VMware version 4.0.1	Parameter name in Splunk Add-on for VMware version 4.0.2
managed_host_whitelist	managed_host_includelist
managed_host_blacklist	managed_host_excludelist
vm_metric_whitelist	vm_metric_allowlist
vm_metric_blacklist	vm_metric_denylist
host_metric_whitelist	host_metric_allowlist
host_metric_blacklist	host_metric_denylist
cluster_metric_whitelist	cluster_metric_allowlist
cluster_metric_blacklist	cluster_metric_denylist
rp_metric_whitelist	rp_metric_allowlist
rp_metric_blacklist	rp_metric_denylist
vm_instance_whitelist	vm_instance_allowlist
vm_instance_blacklist	vm_instance_denylist
host_instance_whitelist	host_instance_allowlist
host_instance_blacklist	host_instance_denylist
cluster_instance_whitelist	cluster_instance_allowlist
cluster_instance_blacklist	cluster_instance_denylist
rp_instance_whitelist	rp_instance_allowlist
rp_instance_blacklist	rp_instance_denylist
perf_entity_blacklist	perf_entity_denylist

• In the vCenter configuration, you'll see inputs for "Host Includelist Regex" and "Host Excludelist Regex" instead of "Host Whitelist Regex" and "Host Blacklist Regex", to allow or block the performance data collection of certain hosts present in the vCenter server.
• In the Data Collection Preference, you'll see inputs for "Metric Allowlist" and "Metric Denylist" instead of "Metric Whitelist" and "Metric Blacklist", to allow or block the data collection of specific metrics.

Version 3.4.6

Version 3.4.6 of the Splunk Add-on for VMware includes a redesigned Collection Configuration page for the collection of Data Collection Node and Virtual Center data.

Version 3.4.0

Version 3.4.0 of the Splunk Add-on for VMware includes an updated Collection Configuration page for the collection of Data Collection Node and Virtual Center data.

The Collection Configuration page can now be used to set interval and expiration times for the performance parameters of the Splunk Add-on for VMware.

This information can also be adjusted using ta_vmware_collection.conf in $SPLUNK_HOME/etc/apps/TA_vmware/local/.

Upgrade from versions 3.3.1 and earlier

In the release 3.3.2, the SA-Utils component has been renamed to SA-VMNetAppUtils. It does not change the input and dashboard you configured in Splunk Add-on for VMware and Splunk App for VMware.

In the release 3.4.2, a new component, SA-VMWIndex has been added to the Splunk Add-on for VMware package. This component contains the indexes.conf which has the definitions of all the indexes [vmware-perf, vmware-inv, vmware-taskevent, vmware-vclog, vmware-esxilog]. The indexes.conf will be removed from all the components of VMware Add-on as these have been added to SA-VMWIndex.

In the release 3.4.3, a new component, TA-VMW-FieldExtractions has been added to the Splunk Add-on for VMware package. This component contains the search time knowledge objects. The search time knowledge objects have been removed from Splunk_TA_vmware.

See the upgrade section of the Splunk App for VMware manual for the detailed procedures.

Note:Splunk recommend you backup your existing deployment before upgrade.
See "Back up configuration information" in the Admin Manual and "Back up indexed data" in the Managing Indexers and Clusters Manual

Fixed Issues

Date resolved	Issue number	Description
2017-04-07	VMW-4484	Support of all ESXi logs format - Correct the sourcetype and field extraction regex (Splunk_TA_esxilogs)
2017-03-30	VMW-4428	Splunk_TA_vcenter Add-on field extraction
2017-03-17	VMW-4320, NETAPP-809	Certification Validation is disabled
2017-03-03	VMW-4437	Splunk unable to connect to some vcenters - vcenters being marked as dead
2017-02-28	VMW-4501, NETAPP-800	Deprecated supportSSLV3Only = <bool> still being used in the latest version of vmware
2017-02-08	VMW-4449	Remove logging of Splunk session keys
2017-02-06	VMW-4380	Splunk DCN making excessive DNS queries

Known Issues

Date filed	Issue number	Description
2019-01-07	VMW-4960	vpxd.stats.maxQueryMetrics error prevents data collection from vCenters
2018-08-27	VMW-4907	Licence Issue for Partner NFR
2018-04-10	VMW-4840	Scrolling issue in Collection Configuration page
2018-02-15	VMW-4825, VMW-4795	Security Scan Failure for port 8008 SA-Hydra for accepting aNULL Cipher Suite
2017-12-11	VMW-4794	Performance fields are not extracted from vmware:perf:vflashModule sourcetype
2017-08-18	VMW-4658	source=VMPerf:VirtualMachine event missing while one of the vCenters is unreachable
2017-05-19	VMW-4597	Not getting "vmware:vclog:vws" sourcetype in vCenter v6.5.
2017-05-19	VMW-4598	"opId" field is not getting extracted properly for few events from "vmware:vclog:vpxd" source type.