About Installing Splunk App for VMware

About Splunk App for VMware

Splunk App for VMware provides visibility into performance metrics, logs, and tasks, events, and topology from hosts, virtual machines, and virtual centers. It provides a real-time picture of the health of the environment, identifying performance and capacity bottlenecks.

In production, Splunk for VMware App is typically a portion of the overall deployed solution. Splunk Enterprise monitors the health of dependencies in a VMware environment, including log and performance data from the following sources:

• Storage for data stores, such as SAN or NAS
• Network devices providing the networking backbone of the virtualization environment
• Authentication logs from sources such as Active Directory, LDAP, and so on
• DNS, DHCP, BootP logs
• Operating system and application logs from virtual machines

Splunk App for VMware Installation

The Installation Guide describes a basic installation of Splunk App for VMware 3.1.1. Use the basic installation to evaluate functionality, or use it with a simple Splunk Enterprise instance in production.

The Installation Guide assumes the following:

• You have Splunk Enterprise 6.0 or later installed and ready to use. Your Splunk environment can be a single-instance deployment, or a deployment with a dedicated search head and one or more indexers. Your search head must run on a 64-bit Linux operating system.
• You are using a supported version of VMware vCenter Server to manage hypervisors. Splunk App for VMware integrates with a vCenter Server and the hypervisors it manages. Splunk App for VMware works with vCenter Server versions 4.0, 5.0, 5.0 Update 1, 5.1, and 5.5.
• You are using a standard deployment configuration. The Installation Guide describes installing Splunk App for VMware with Data Collection Node (DCN) virtual appliances in their standard configuration. See "Set up a data collection node" in the Configuration Guide to learn how to create a custom DCN.

Additional Considerations:

• If you are evaluating Splunk App for VMware and are already using Splunk Enterprise in production, consider installing Splunk App for VMware in a test environment. See "Plan your installation in a test environment."
• You can use Splunk App for VMware with Splunk Enterprise deployments that use search head pooling and geographically-tied data collection. Within these complex deployments, you must use non-pooled, location-specific Splunk Enterprise servers to act as schedulers for Splunk App for VMware. Contact your sales engineer or Splunk Technical Support for planning assistance.
• If your deployment includes NetApp devices, install and configure Splunk App for NetApp Data ONTAP before you install Splunk App for VMware. See "Prepare your Splunk App for NetApp."

Configure a complex deployment

See the Configuration Guide for instructions on using Splunk App for VMware in a complex Splunk Enterprise deployment.

• Deploy the app in a search head pooled environment
• Deploy the app in a indexer cluster deployment
• Create a custom data collection node