Splunk® Supported Add-ons

Splunk Add-on for VMware Metrics

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Deploy a Data Collection Node with the Splunk Add-on for VMware Metrics

Deploy a Data Collection Node (DCN) to collect data from VMware vSphere vCenter Servers. You can deploy a DCN with the Splunk OVA for VMware Metrics or manually convert a heavy forwarder into a DCN.

After you deploy a DCN, configure data collection with a Data Collection Scheduler (DCS) from the Collection Configuration page in the Splunk Add-on for VMware Metrics. For information about setting up a DCS, see Deploy a Data Collection Scheduler with the Splunk Add-on for VMware Metrics.

Prerequisites

  • You viewed the DCN requirements. See Data Collection Node requirements.
  • The Data Collection Node for Splunk Add-on for VMware and Splunk Add-on for VMware Metrics cannot be the same instance. So, the instance on which you are deploying the Add-on package should not be the DCN of the Splunk Add-on for VMware already.

Deploy a DCN with the Splunk VMware OVA for VMware Metrics

Deploy the Splunk OVA for VMware Metrics in a vCenter Server. When you deploy the OVA, it creates a virtual machine running a Splunk heavy forwarder that's configured to be a DCN. For information about specifications for the OVA, see Install the Splunk OVA for VMware Metrics in the Splunk OVA for VMware Metrics manual.

Follow these steps to deploy the OVA and set up the DCN.

1. Deploy DCN with Splunk OVA for VMware Metrics

Download the Splunk OVA for VMware Metrics from Splunkbase.

2. Deploy the DCN in a vCenter Server

Use the OVA to create a virtual machine in your vCenter Server to run the DCN. For information about deploying an OVA, see Deploy an OVF or OVA Template on the VMware website.

For information about DCN requirements, see Data Collection Node requirements.

After you deploy the OVA, the vCenter Server automatically assigns an IP address to the DCN via DHCP. For the most reliable connection, configure a static IP address for the DCN if possible.

Follow these steps to set up the DCN after you deployed the OVA in a vCenter Server.

  1. SSH into the virtual machine that's running the DCN.
  2. Log in to the virtual machine as the root user:
    username: root
    password: changemenow
    
  3. Change the password:
    # passwd
    
  4. Run the dcn-network-config command to test the network configuration for the DCN. Press Enter for each setting you don't want to change. When you finish, the dcn-network-config command tests your network configuration. These are the settings you can modify:
    IPv4 address
    IPv4 address of the default gateway
    Netmask
    DNS/Nameserver
    Hostname
    

3. Configure the DCN

  1. Log in to the virtual machine with these user credentials:
    username: splunk
    password: changeme
    
  2. Run the dcn-splunk-config command and enter a new password for the admin user for the universal forwarder. Before you change the password for the admin user, the default password is changeme.
  3. Configure these settings:
    Setting Description
    Enter comma separated Indexers(<host>:<port>)[] Enter the IP address and port of each indexer you want to forward data to. For more information about forwarding data directly to indexers, see Connect forwarders directly to peer nodes in the Splunk Enterprise Managing Indexers and Clusters of Indexers guide.
    Enter license master(https://<host>:<port>)[self] You don't have to configure the DCN as a license slave to collect data from the VMware vCenter Server. Press Enter to continue without providing a license master.
  4. Save your changes and restart Splunk.

Configure a heavy forwarder to be a DCN

Follow these steps to configure an existing heavy forwarder as a DCN. If you use a heavy forwarder that's performing other tasks, you may run into performance issues. For the best performance, configure a heavy forwarder to be a dedicated DCN, especially if you want to monitor vCenter Servers that are near or at the maximum number of ESXi hosts and virtual machines a DCN can manage. For information about DCN requirements and limits, see Data Collection Node requirements.

1. Install the add-ons

Install the following add-ons on the heavy forwarder. Download the following add-on from Splunkbase. To install the add-on, extract the add-on tgz packages to $SPLUNK_HOME/etc/apps.


Splunkbase name Add-on Description
Splunk Add-on for VMware Metrics
  • Splunk_TA_vmware_inframon
  • SA-Hydra-inframon
  • Runs a Python-based API data collection engine and performs search-time tagging of VMware data.
  • Runs worker processes to collect VMware data from vCenter Servers.
Splunk Add-on for VMware ESXi logs Splunk_TA_esxilogs Runs props and transforms for ESXi log data you forward to the DCN. If you don't forward ESXi log data to the DCN and instead forward ESXi log data directly to the indexer tier, you don't have to install this add-on on the DCN.
Splunk Add-on for vCenter logs Splunk_TA_vcenter Runs props and transforms for vCenter Server log data you forward to the DCN. If you don't forward vCenter Server log data to the DCN and instead forward vCenter Server log data directly to the indexer tier, you don't have to install this add-on on the DCN.

2. Configure forwarding

Configure the heavy forwarder to send data to your indexer or distributed indexer environment.

Follow these steps to configure forwarding:

  1. Enable forwarding on the heavy forwarder. For information about deploying a heavy forwarder, see Set up forwarding in the Splunk Enterprise Forwarding Data guide.
  2. Specify the indexer or group of indexers you want to forward data to. There are two options to do this:
    1. Manually specify each indexer you want to forward data to. For more information about forwarding data directly to indexers, see Connect forwarders directly to peer nodes in the Splunk Enterprise Managing Indexers and Clusters of Indexers guide.
    2. Configure indexer discovery to forward data to indexers. For information about how to use indexer discovery, see Use indexer discovery to connect forwarders to peer nodes.
Last modified on 13 September, 2023
PREVIOUS
Set up your system for the Splunk Add-on for VMware Metrics
  NEXT
Deploy a Data Collection Scheduler with the Splunk Add-on for VMware Metrics

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters