Splunk® App for VMware (Legacy)

Installation and Configuration Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.

The data collection components

The Splunk Forwarder Virtual Appliance for VMware (FA VM) sends data to your Splunk indexers after you configure engine.conf and inputs.conf files. These configuration files enable the FA VM to run engine.pm, the main data collection module inside the FA VM.

Components for collecting data

Component Description
Forwarder Appliance (FA VM) This is the FA VM that contains a CentOS 5.7 Linux image, Splunk heavyweight forwarder, and a pre-installed add-on (the Splunk_TA_vmware) that gathers data from VMware by calling the APIs.
engine.pm (the engine) This is the main data collection module inside the FA VM. Multiple engine.pm processes can run concurrently.engine.pm is a set of scripts that call VMware’s Perl SDK to get data from the VMware environment and send it to Splunk. It controls data collection in your VMware environment. engine.pm reads the data discovery modules in engine.conf that tells the module where to look for the data, the data to collect, and the frequency with which it should gather data. The number of engine.pm instances run is determined by the specifications set in the inputs.conf file.
engine.conf This Splunk configuration file contains information about the target machines in your vSphere environment that you will manage as part of the Splunk for VMware Solution. It also specifies the data you want to collect from your environment and the frequency with which you want to collect it. The engine.conf file contains stanzas that correspond to the vCenter machines or ESX/i hosts from which you want to collect data. actions that specify the data collection requirements for your target machines are contained within these stanzas are the intervals and other settings that correspond to data collection frequency.This file is read by engine.pm.
action This is a setting in the engine.conf file that tells engine.pm the data type to collect from your target machines. The data type is associated with an action keyword. For example, to collect hierarchy data use the action “HierarchyDiscovery” in engine.conf. Many actions can be listed for a given target machine in a given stanza.
Last modified on 22 August, 2013
How data is collected   Logincreator.pl

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 1.0, 1.0.1, 1.0.2, 1.0.3, 2.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters