Splunk® App for VMware (Legacy)

Installation and Configuration Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.

Clean up older installations

Clean up older versions of Splunk for VMware

If you have a version of Splunk for VMware prior to the 1.0GA release installed and deployed in your environment, remove it and clean up your installation before you deploy Splunk for VMware 1.0GA.

Remove the Splunk App for VMware

To remove the Splunk App for VMware from all of your search heads/indexers:

  1. Stop Splunk on all search heads/indexers where the Splunk App for VMware was installed.
  2. Copy your $SPLUNK_HOME/etc/apps/splunk_for_vmware/local directory to a temporary location. The local directory contains all of the customizations that you made in the App (custom views, saved searches, macros, and so on).
  3. Go to $SPLUNK_HOME/etc/apps/splunk_for_vmware to locate the App and remove the entire App directory and all of its sub-directories on all of your search heads / indexers.
  4. Remove all of the old VMware data on all of your search heads/indexers:
    splunk clean eventdata vmware -f
  5. You can now install Splunk for VMware 1.0 on your search heads/indexers. See the Splunk for VMware Installation and Configuration Guide for detailed instructions. If you do not want to install Splunk for VMware, you can start your Splunk instance on all of your search heads/indexers now.

Remove the Splunk Add-on for vCenter

To remove the Splunk Add-on for vCenter from your vCenter Server forwarders:

  1. On the vCenter Server machines where the previous Splunk Add-on for vCenter version was installed, shut down the Splunk forwarder.
  2. If you created an inputs.conf.template file (containing your VC instance name) in $SPLUNK_HOME/etc/apps/splunk_for_vmware_vcenter/local, copy it to a temporary location.
  3. Remove the entire Add-on directory, $SPLUNK_HOME/etc/apps/splunk_for_vmware_vcenter , and all of its sub-directories on all of your vCenter Servers.
  4. You can now install Splunk for VMware 1.0 on your vCenter forwarders. See the Splunk for VMware Installation and Configuration Guide for instructions on how to do this. If you do not want to install Splunk for VMware 1.0, start the Splunk forwarder on all of your vCenter Servers now.

Shut down and de-commission the Splunk FA VM

To shut down and de-commission the Splunk FA VM:

  1. Log into the FA VM as the “splunkadmin” user.
  2. Stop splunk in the FA VM:
    splunk stop
  3. Copy all custom configurations that you made in your FA VM (for example, outputs.conf, engine.conf, inputs.conf) and save a copy of your “local” config files to a temporary location. You can find all the files in #: $SPLUNK_HOME/etc/apps/splunk_for_vmware/local or $SPLUNK_HOME/etc/system/local.
  4. Shutdown the OS and halt operation:
    sudo shutdown –h now
  5. Your previous FA VM version is now de-commissioned and you can deploy a new version of the FA VM. See the Splunk for VMware Installation and Configuration Guide for instructions on how to install Splunk for VMware 1.0.
Last modified on 10 January, 2013
Upgrade from 1.x to 1.0.3   About the examples

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 1.0.2, 1.0.3


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters