Collect VMware vCenter Server metrics with Splunk App for Infrastructure

Configure VMware vCenter Server integrations with a Data Collection Scheduler (DCS) to collect metrics. A DCS schedules data collection jobs for Data Collection Nodes (DCN). DCNs are modified heavy forwarders that collect data from a vCenter Server. You can deploy a DCN with the Splunk VMware OVA for ITSI or as a heavy forwarder that you modify manually. SAI doesn't discover a DCN as an entity when you integrate it with a DCS, but if you're running the DCN as a virtual machine in a vCenter Server you're integrating, you can monitor the DCN that way. If you deploy the DCN on a Linux system, you can also configure a Linux integration for it.

Before you can start configuring data collection for VMware vCenter Servers, you have to install additional components in your environment, deploy a DCS, and deploy at least one DCN for each vCenter Server you want to monitor. A single DCS can schedule data collection jobs for multiple DCNs. For information about scaling DCNs for vCenter Servers, see Data Collection Node requirements and limits in the Install and Upgrade Splunk App for Infrastructure guide. The easiest way to deploy a DCN is to use the OVA template. You can also modify a heavy forwarder to perform as a DCN.

You also need to confirm that the proper ports are available and open in your Splunk and vCenter Server environments. To view all the VMware data collection requirements, see VMware data collection planning and requirements in the Install and Upgrade Splunk App for Infrastructure guide.

View these topics in the Install and Upgrade Splunk App for Infrastructure guide to install the required components, deploy a DCN, and deploy a DCS if you haven't already:

• Install VMware data collection add-ons and dependencies
• Deploy a Data Collection Node
• Deploy a Data Collection Scheduler

Start collecting these types of data when you integrate a vCenter Server on a DCS:

• Metrics
• Task
• Inventory
• Event

DCNs send data to the vmware-perf-metrics metrics index.

To configure vCenter and ESXi host log data collection, see Collect VMware vCenter Server and ESXi host log data with Splunk App for Infrastructure.

You discover these entities and default dimensions when you integrate a vCenter Server:

Entity	Dimensions
vCenter	entity_type host instance moid pool_name vcenter vmware_metric_aggregation
ESXi Cluster	entity_type host instance moid pool_name vcenter vmware_metric_aggregation
ESXi host	cluster cluster_name datastore entity_type host ip moid name os os_version pool_name uuid vcenter
Virtual machine	cluster cluster_name datastore entity_type host hypervisor hypervisor_name ip moid name os os_version pool_name resourcepool uuid vcenter

Prerequisites

• You deployed a DCN. For more information, see Deploy a Data Collection Node in the Install and Upgrade Splunk App for Infrastructure guide.
• You deployed a DCS. For more information, see Deploy a Data Collection Scheduler in the Install and Upgrade Splunk App for Infrastructure guide.

Integrate a vCenter Server

Follow these steps to start collecting data from a vCenter Server. You have to integrate a vCenter Server on a DCS. Don't try to integrate a vCenter Server on a search head that hasn't been set up as a DCS. Go to the Add Data page in SAI:

1. In the SAI user interface, click the Add Data tab.
2. Select VMware vSphere in the integration panel.
3. Select the vCenter tab and click Add vCenter.

1. Add vCenter credentials

Specify the vCenter Server you want to integrate, and include admin user credentials so that SAI can connect to the vCenter Server.

Configure these settings:

Setting	Description
Domain name	Enter the fully qualified domain name (FQDN) of the vCenter Server you want to integrate.
Username	Enter the name of an admin user for the vCenter Server. If the user is an Active Directory account, use the username@domain format.
Password	Enter the password for the admin user.

2. Configure data collection

By default, you collect data from every ESXi host and virtual machine. To select a subset of ESXi hosts, disable Collect data from all hosts to allow or block specific ESXi hosts. Use a regular expression to capture ESXi hosts you want to allow or block.

Allowing an ESXi host or set of ESXi hosts automatically blocks every ESXi host the regular expression doesn't capture. Similarly, blocking an ESXi host or set of ESXi hosts automatically allows every ESXi host the regular expression doesn't capture.

3. Save the configuration

When you're done, click Save to submit the integration.

It can take about 5-10 minutes before you start seeing the vCenter and every cluster, ESXi host, and virtual machine, especially if you're integrating a larger VMware environment.

Bulk upload vCenter Servers

You can upload a CSV file that contains credentials for multiple vCenter Servers to integrate more than one vCenter Server at a time. There's no limit to how many vCenter Servers you can upload in a single bulk upload. All passwords are encrypted when you submit the bulk upload.

The CSV file must be a table that looks like this:

FQDN	Username	Password
example1.com	username1	buttercup123
example2.com	username2	buttercup456

Follow these steps to bulk upload vCenter Servers.

1. In the SAI user interface, click the Add Data tab.
2. Select VMware vSphere in the integration panel.
3. Select the vCenter tab and click Add vCenter.
4. Under Integrate multiple vCenter Servers in a bulk upload, click Download the CSV template to view an example of what the CSV file needs to look like.
5. Upload the CSV file that contains credentials for each vCenter Server you want to integrate.
6. Review the credentials and click Save to submit the bulk upload.

Integrate a DCN

Follow these steps to integrate a DCN you deployed to collect VMware vCenter Server data. When you integrate a DCN, a DCS starts scheduling jobs for the DCN to collect VMware vCenter Server data. You have to integrate a DCN on a DCS. Don't try to integrate a DCN on a search head that hasn't been set up as a DCS. Go to the Add Data page in SAI:

1. In the SAI user interface, click the Add Data tab.
2. Select VMware vSphere in the integration panel.
3. Select the DCN tab and click Add DCN.

1. Enter the heavy forwarder credentials

Specify the DCN you want to integrate, and select how many worker processes the DCN runs. A worker process runs on the DCN to collect VMware data. For more information about worker processes, see Data Collection Node requirements and limits in the Install and Upgrade Splunk App for Infrastructure guide.

Configure these settings:

Setting	Description
Heavy forwarder	Enter the hostname or IP address and management port of the heavy forwarder that runs the DCN. By default, the management port is 8089.
Username	Enter the name of an admin user for the heavy forwarder that runs the DCN.
Password	Enter the password for the admin user.
Worker processes	Select how many worker processes you want to run on the DCN. You can run up to 30 worker processes on each DCN, depending on how many CPU cores you allocated to the DCN. Each worker process can manage up to 250 virtual machines and 10 ESXi hosts.

2. Save the configuration

When you're done, click Save to submit the integration.

It can take about 5-10 minutes before the DCN starts scheduling jobs for the DCN.

Bulk upload DCNs

You can upload a CSV file that contains credentials for multiple DCNs to integrate more than one DCN on a DCS at a time. There's no limit to how many vCenter Servers you can upload in a single bulk upload. All passwords are encrypted when you submit the bulk upload.

The CSV file must be a table that looks like this:

URI	Username	Password	Worker Processes
example1.com	username1	buttercup123	4
example2.com	username2	buttercup456	8

Follow these steps to bulk upload DCNs.

1. In the SAI user interface, click the Add Data tab.
2. Select VMware vSphere in the integration panel.
3. Select the DCN tab and click Add DCN.
4. Under (Optional) CSV Bulk Upload, click Download the CSV template to view an example of what the CSV file needs to look like.
5. Upload the CSV file that contains credentials for each vCenter Server you want to integrate.
6. Review the credentials and click Save to submit the bulk upload.

Test data collection

It can take up to about 10 minutes after you start the DCS to collect data from DCNs. When you should be receiving data from a DCN, run a search to confirm whether you're receiving data.

You can run this search to confirm whether you're receiving metrics in the vmware-perf-metrics index:

|mstats latest(_value) where metric_name=* AND index=vmware-perf-metrics by metric_name