Collect Windows VMware vCenter Server log data

You do not need to collect log data from Windows VMware vCenter Servers to see a working version of the Splunk App for VMware.

Install the Splunk Technology Add-on for VMware vCenter to collect vCenter Server log data. Use a Splunk Universal Forwarder to forward the log data from your Windows vCenter Server to the indexer.

1. Install a Splunk forwarder.

• Download the Universal Forwarder.
• Install the Universal Forwarder. See Install a Universal Forwarder on Windows.

2. Configure forwarding. Configure the forwarder on your vCenter Server systems to send data to your indexers. Configure the forwarder in the outputs.conf file for each forwarder installed on a vCenter Server system. See Configure forwarding with outputs.conf.

3. Change your Splunk password.

• The default password for the Splunk Enterprise admin user is changeme. Change the password using Splunk Web. See "Change the admin default password" in the Admin Manual.

4. Install Splunk_TA_vcenter.

• Get the file Splunk_TA_vcenter-<version>-<build_number>.zip from the download package and install it on your vCenter Server systems.
• Unzip the file, "Splunk_TA_vcenter-<version>-<build_number>.zip", into the apps directory under %SPLUNK_HOME%\etc\apps. When installing on a universal forwarder the path is C:\Program Files\SplunkUniversalForwarder\etc\apps otherwise it is C:\Program Files\Splunk\etc\apps.

5. Restart Splunk Enterprise. See "Start and stop Splunk" in the Admin Manual.

6. In %SPLUNK_HOME%\bin run the command splunk restart. Alternatively, select Start > Administrative Tools > Services > Splunkd restart in Windows services.

Splunk App for VMware collects log data from your Windows vCenter Server systems and forwards the data from vCenter Server to your Splunk indexers or combined indexer search heads.