Configure the Splunk OVA for VMWare

Configure the DCN system settings

To maintain a successful connection to the Splunk platform scheduler, configure the DCN virtual appliance to use a static IP address and host name.

1. Log in to the DCN. Use the default DCN login credentials to make operating system level changes. The default credentials are root/changemenow.

2. Connect to the data collection node.

• If you have DHCP on your network, when you first power on the DCN it shows a temporary IP address. You can find the IP address through the vCenter console Summary page for the virtual machine. Use SSH to remotely connect to the DCN.
• If the network can not automatically assign an IP address to the DCN on start up, or if you can not access the DCN using SSH, open a vCenter console to connect to the DCN virtual machine.

3. Set the root password to a secure value.

passwd

4. Manually configure the host name, IP address, and network settings for the DCN.

a. Write a static IP address and netmask to the file /etc/sysconfig/network-scripts/ifcfg-eth0.

cd /etc/sysconfig/network-scripts

echo DEVICE=eth0 > ifcfg-eth0

echo ONBOOT=yes >> ifcfg-eth0

echo BOOTPROTO=static >> ifcfg-eth0

ifconfig eth0 | grep HWaddr | sed -e 's/.*HWaddr /HWADDR=/' >> ifcfg-eth0

echo IPADDR=[your IP address] >> ifcfg-eth0

echo NETMASK=[your netmask] >> ifcfg-eth0

cat /etc/sysconfig/network-scripts/ifcfg-eth0

b. Configure network settings.

cd /etc/sysconfig

echo NETWORKING=yes > network

echo HOSTNAME=[your hostname] >> network

echo GATEWAY=[your gateway] >> network

cat /etc/sysconfig/network

c. Configure the Domain Name System (DNS).

echo "search yourdomain.com" > /etc/resolv.conf

echo "nameserver [IP address of your nameserver]" >> /etc/resolv.conf

echo "nameserver [IP address of your nameserver]" >> /etc/resolv.conf

cat /etc/resolv.conf

d. Restart the DCN to accept the new configuration settings.

reboot

Next, configure the DCNs to work with Splunk Enterprise. See "Configure the DCN for your Splunk Enterprise environment ."

Configure the DCN for your Splunk platform environment

Configure the Splunk platform connection settings for each DCN that you deploy in your environment.

1. Use SSH to remotely connect to to the DCN using the Splunk Enterprise admin operating system credentials splunkadmin/changeme. These credentials have the $SPLUNK_HOME and path settings that allow you run Splunk Enterprise commands from the command line interface.
2. Set the splunkadmin password to a secure value.
3. From the command line, start Splunk Enterprise.

   splunk --accept-license start

4. Enable Splunk Enterprise to start at reboot.

   sudo /home/splunkadmin/opt/splunk/bin/splunk enable boot-start 

5. Change the password of the admin user account. These user credentials enable you to connect to Splunk Enterprise.

   splunk edit user admin -role admin -auth admin:changeme -password <new_password>

6. Set outputs to use Splunk Enterprise indexers. For each data collection node, set up forwarding to the port on which the Splunk indexer(s) is configured to receive data. By convention, indexers listen on port 9997. Check that your indexers are listening on port 9997, or whichever port you set for the data collection node outputs.

   splunk add forward-server <ip_address:9997>

7. Confirm that the outputs you configured are correct.

   splunk list forward-server

8. • For DCNs used in production, tie the license of the DCN to your license master:

   splunk edit licenser-localslave -master_uri https://myhost:8089

9. Restart Splunk Enterprise to enable changes.

   splunk restart

10. Log out of the DCN. Next, log in to the Splunk scheduler and configure the data collection node to collect API data from your vCenter environment. See "Configure Splunk App for VMware to collect data from vCenter Server".

    Configure the Splunk OVA to a partition (Optional)

    if your Splunk OVA needs more than 6GB of storage space, you need to create a new partition on the OVA machine, and have SPLUNK_DB point to that partition.

    1. Create a new partition on the OVA machine

    Go to Managing Disk Storage to learn how to create a new partition.

    2. Point SPLUNK_DB to your new partition

    Once your new partition has been created, point SPLUNK_DB to the newly-created partition. To learn how to point SPLUNK_DB to your new partition, read "Move the index database".

    Configure DCNs to scale vertically (Optional)

    You can configure more than 8 worker processes per DCN by scaling your Splunk Enterprise environment vertically. This lets you increase the number of available worker processes from 8, up to 30.

    Note: It is possible to configure more worker processes per DCN, but adding more DCNs as scaling workers to enable horizontal scaling is the recommended deployment practice.

    Use the Collection Configuration page to register a DCN with the scheduler

    The Collection Configuration page, on your Splunk platform scheduler, manages the Data Collection Nodes (DCNs). Register and configure each DCN separately with the Collection Configuration page in order to collect data from vCenter Server.

    1. Log in to Splunk Web on your scheduler as admin.
    2. From the App menu, select Splunk Add-on for VMware.
    3. Navigate to Collection Configuration, then click +.
    4. Enter the settings for the data collection node, then Click Save. Data Collection Node configuration settings

       Field	Value
       Splunk Forwarder URI	The address or port of the DCN. For example, https://<host_name_or_ip_address_of_DCN>:8089.
       Splunk Forwarder Username	admin.
       Splunk Forwarder Password	The administrator password. Make sure this password is not the Splunk Enterprise default admin password (changeme).
       Worker Processes	The number of worker processes must be one fewer than the number of CPU cores the vCenter Server system granted to the DCN. For example, if the DCN has four CPU cores, the number of worker processes is three.

    5. Confirm that you correctly configured the DCN by verifying that the DCN, credential validation, and add-on validation all display a green check.
    6. Repeat the steps for each DCN.