Splunk® App for VMware (Legacy)

Configuration Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.

Add, edit, or delete a VMware vCenter Server

Add a vCenter Server

Add a VMware vCenter Server and configure it as a source of data in your environment. You must add and configure each vCenter Server individually.

Note: When you add a vCenter Server to your environment, make sure that the Distributed Collection Scheduler is not running.

  1. Stop the Distributed Collection Scheduler.
  2. On the Collection Configuration dashboard, in the Virtual Centers panel, click +.
  3. Configure the vCenter Server as a source of data.
    1. Enter the fully qualified domain name for the vCenter Server. For example, test-vcenter100.example.com is a fully qualified domain name for a vCenter Server.
    2. Enter the vCenter Server user name. For example, administrator is a user name for a local user. splunkadmin@splunk.local is a user name for an Active Directory domain user.
    3. Enter the vCenter Server password. This is the password you use to access the vCenter Server.
    4. Collect vCenter Server logs. Select the check box to enable data collection. Specify the following information for the vCenter Server logs.
      1. Enter the vCenter Server Splunk forwarder URI. For example, https://test-vcenter100:8089 is a valid vCenter Server Splunk forwarder URI.
      2. Enter the vCenter Server Splunk forwarder user name. For example, the default user name is admin.
      3. Enter the vCenter Server Splunk forwarder password. For example, the default password is changeme.
    5. Choose the hosts from which you want to collect data. The Collect from all hosts setting is enabled by default. Select the check box to disable data collection from all hosts. Select the check box for individual hosts from which you want to collect data. To specify collection from specific hosts, enter a regular expression in the Host whitelist Regex field.
  4. Click Save.
  5. Verify that the vCenter Server is configured correctly. A correctly configured vCenter Server has a green check mark in it and a green check box that indicates credential validation.
  6. Click the magnifying glass next to hosts to verify that the correct hosts are in the data collection configuration and the Excluded Hosts list.
  7. Click Close.
  8. Restart the Distributed Collection Scheduler.

Edit vCenter Server settings

  1. On the Collection Configuration dashboard, select a vCenter Server.
  2. Click the pencil icon.
  3. Edit the properties for the vCenter Server configuration in your Splunk environment.
  4. Click Save.

Delete a vCenter Server

When you delete a vCenter Server, Splunk App for VMware stops collecting data from it.

Note: When you remove a vCenter Server from your environment, make sure that the Distributed Collection Scheduler is not running.

  1. Stop the Distributed Collection Scheduler.
  2. On the Collection Configuration dashboard, select the vCenter Server.
  3. Click the trash can icon.
  4. Confirm that you want to delete the vCenter Server.
  5. Click Save.
  6. Restart the Distributed Collection Scheduler.
Last modified on 22 June, 2016
Add, edit, or delete a data collection node   Use the Distributed Collection Scheduler to collect data from all hosts

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 3.3.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters