Splunk® App for VMware (Legacy)

Installation Guide

Acrobat logo Download manual as PDF


On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

About the Splunk App for VMware

The Splunk App for VMware provides visibility into performance metrics, logs, tasks, events, and topology from hosts, virtual machines, and virtual centers. It provides a real-time picture of the health of the environment, identifying performance and capacity bottlenecks.

In production, the Splunk App for VMware is typically a portion of the overall deployed solution. Splunk Enterprise monitors the health of dependencies in a VMware environment, including log and performance data from the following sources:

  • Storage for data stores, such as SAN or NAS
  • Network devices providing the networking backbone of the virtualization environment
  • Authentication logs from sources such as Active Directory, LDAP, and so on
  • DNS, DHCP, BootP logs
  • Operating system and application logs from virtual machines

Distributed installation

Use the tables below to determine where and how to install the Splunk app for VMWare in a distributed deployment of Splunk Enterprise.

Splunk instance type Supported Required Comments
Search Heads Yes Yes Install this app to all search heads where VMWare knowledge management is required.
Indexers Yes Yes Required monitor VMWare data output.
Heavy Forwarders Yes Yes Required if you use a heavy forwarder rather than a light or universal forwarder to monitor VMWare syslog output.
Universal Forwarders Yes Yes Required if you use a universal forwarder rather than a light or heavy forwarder to monitor VMWare syslog output.
Light Forwarders Yes Yes Required if you use a light forwarder rather than a universal or heavy forwarder to monitor VMWare syslog output.

Supported VMware operating environments

Use the below table to identify which operating environment works with each Splunk platform component within the Splunk app for VMware.

Component Linux Supported Windows Supported
Search Head X
Indexer X X
DCN X
Forwarder (Universal, Heavy, Light) X X

Distributed deployment compatibility

This table provides a quick reference for the compatibility of the splunk app for VMWare with Splunk distributed deployment features.

Distributed deployment feature Supported Comments
Search Head Clusters Yes Learn about VMWare search head clustering configuration.
Indexer Clusters Yes Use the cluster master to deploy your technology add-on packages.
Deployment Server Yes Learn about using the deployment server.

Configure a complex deployment

See the Configuration Guide for instructions on using Splunk App for VMware in a complex Splunk Enterprise deployment.

Last modified on 22 June, 2016
  NEXT
Download the Splunk App for VMWare

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 3.1.3, 3.1.4, 3.2.0, 3.2.1, 3.2.2


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters