Audience and Features

Audience

You are a Solutions administrator or a Splunk Enterprise technical user who has a good understanding of Splunk Enterprise. You might also have knowledge of virtualized environments. This manual explains how to:

1. Download and install the Splunk App for VMware to work with Splunk Enterprise.

2. Configure the app to collect data from your VMware environment.

3. Index your data in Splunk Enterprise.

4. Map the data to the dashboards in the Splunk App for VMware.

Splunk App for VMware Features

The Splunk App for VMware, version 3.1, provides an update to the data collection framework that collects API data from your VMware environment. Using the updated data collection framework you can easily scale the app to collect data from larger environments.

The app targets the proactive monitoring and troubleshooting of your environment. You can identify issues quickly and drill down to those issues using the dashboards.

Features of this release include:

• Proactive monitoring of your virtual infrastructure.
• A visual interactive topology map of your virtual environment, highlighting problems and statistical comparisons based on predefined thresholds.
• Views that provide insight into how your environment performs along with details on performance, availability, security, and capacity and change tracking.
• Capacity Planning and Capacity Forecasting dashboards.
• Correlation of VMware virtualization data with NetApp NFS datastores.
• Views that show the operational health of your environment, identifying underperforming or distressed hosts, virtual machines, and datastores.
• A security view that provides visibility into potential security breaches and non-compliant usage patterns.
• The collection of granular performance metrics and log data all in one place, directly collected from VMware vCenter Servers and ESXi and vCenter logs (collected using syslog).
• The ability to explore large data volumes, quickly, with access to fast queries on performance data.
• Track changes with visibility into VMware vCenter Server tasks and events in the context of your virtual environment.

What you should know before using the app

To get the Splunk App for VMware working in your environment, it helps if you:

• Know the Splunk Search Processing Language (SPL).
• Have knowledge about how indexes, sources, source types, and field extractions work.
• used Splunk Enterprise. See the Splunk Enterprise product documentation.
• Know your VMware vSphere environment.