Splunk® App for VMware (Legacy)

Installation and Configuration Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.

Install the Perl API package into the FA VM

The following instructions describe how to download and install the vSphere SDK for Perl package (Perl SDK).

What to install

The vSphere SDK for Perl provides an easy-to-use Perl scripting interface to the vSphere API. Download the SDK from VMware's web site and install it into the FA VM for it to work correctly.

Splunk for VMware is compatible with vSphere 4.1, 5.0, 5.0 update 1, and 5.1(it can gather data from vCenter Server and ESXi hosts for these VMware environments). The instructions below explain how to download and install the "5.1" release of the vSphere SDK for Perl.

If you are already running an FA VM, you can check the version of the Perl SDK that you have installed by running the command:

/usr/bin/perl -MVMware::VIRuntime -e 'print $VMware::VIRuntime::VERSION'

If it is installed, the version number of the currently running FA VM is returned. If it is not installed at all, an error is returned.

Download and install the VMware vSphere SDK for Perl

  1. Power on the FA VM: If the Splunk Forwarder Appliance VM (FA VM) you deployed is not already powered on, use the vSphere Client to start it now.
  2. Get the FA VM's IP Address: You will need the FA's IP address for further installation steps:
    • In the vSphere client, select the FA VM, then click the Summary tab. In the "General" panel, the IP address of the FA is displayed. Our FA contains VMware Tools, which makes the IP address known to vSphere.
    • If the IP address does not display in the Summary tab, get it manually by logging into the virtual console in the vSphere Client.
    • Log into the FA VM using the password you set when you deployed it. If you did not change the password, you can use the default credentials:
    • username=splunkadmin and password=changeme
      
    • When logged in, run ifconfig to get the FA VM's IP address.
    • If an IP address is not displayed, assign the FA a static IP address. See "Set static IP addresses" in this manual for details on how to do this. The problem can result from having booted the FA using the default values (DHCP) but not finding a DHCP server
  3. Download the VMware SDK package To Download the SDK package, you must have a user account on the VMware site. Create an account or log in to your existing account. We recommend that you download the .tar.gz file to a location that the FA VM can access over the network (this can be a shared network drive, another server, your local laptop or desktop). In a Web browser, go to:
  4.  http://www.vmware.com/support/developer/viperltoolkit/
  5. Download the correct SDK version:
    • Choose "Release 5.1" on the drop-down menu and click "Download".
    • Login using your VMware user account.
    • Click "yes" to accept the "End-User License Agreement" .
    • On the Download page, click the "Use Web Browser" radio button, then choose the "gz" link for the "vSphere SDK for Perl - 64-bit Linux Installer".
    • The Linux 64-bit PerlSDK package, version 5.1 will be downloaded to the location you specified. The file name is VMware-vSphere-Perl-SDK-5.1.0-780721.x86_64.tar.gz.
  6. Transfer the VMware Perl SDK file to the FA VM: When you have a local copy of the package, use a file transfer program such as scp or WinSCP to transfer the tar.gz file to your FA VM. Transfer the vSphere SDK package file into the /home/splunkadmin/packages directory as the splunkadmin user.
  7. For example, to transfer the file from your local machine, to an FA with an IP address of 192.168.10.10 on another machine, run scp to transfer the file. You will be prompted to supply a password for the splunkadmin user.:

    scp VMware-vSphere-Perl-SDK-5.0.0-615831.x86_64.tar.gz splunkadmin@192.168.10.10:/home/splunkadmin/packages
    

    Note: If you cannot transfer the Perl SDK file, check that the network settings for your FA are correctly configured. Possible problems can include:

    • VLAN misconfiguration for the VM
    • incorrect network settings for the Linux OS inside the FA
    • network infrastructure problems

    See "Troubleshooting virtual machine network connection issues" to help diagnose the problem.

  8. Log into the FA VM as the splunkadmin user: SSH as the splunkadmin user into the FA (or log into the virtual machine console). To verify that the Perl SDK package was transferred correctly, on the FA, check the contents of /home/splunkadmin/packages).
  9. cd packages
    ls
    

    You should see the vSphere Perl SDK file listed.

  10. Extract and install the Perl SDK package:
    1. Untar the file to extract the Perl SDK package
    2. tar -xzvf VMware-vSphere-Perl-SDK-5.1.0-780721.x86_64.tar.gz
      
    3. Change directories into the the vmware-vsphere-cli-distrib folder. This is the install folder.
    4. cd vmware-vsphere-cli-distrib
      
    5. Run the installation script (you may be asked for the splunkadmin user's password):
    6. sudo ./vmware-install.pl
      
    7. When prompted, accept the installation defaults.
  11. Validate your Perl SDK install: Now that your vSphere SDK for Perl installation is complete, you can verify the installation using the example instructions below.

Verify that the Perl API package is installed

Test the connection against a vCenter Server or and ESX/i host for which you have credentials. This example assumes that you have a VC machine located and reachable via the network at 192.168.20.20. You will be prompted for a username and password to access VC. The credentials are the same as those you use to log into the VC via the vSphere Client. Run the following commands on the FA:

cd /usr/lib/vmware-vcli/apps/general
./connect.pl --url https://192.168.20.20/sdk/webService

If the script prints out "Connection Successful," you have validated that the Perl SDK is installed correctly.

Last modified on 19 November, 2012
Configure default properties for the FA VM   Configure forwarding

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 1.0.3








You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters