Deploy a Data Collection Node with the Splunk Add-on for VMware Metrics

Deploy a Data Collection Node (DCN) to collect data from VMware vSphere vCenter Servers. You can deploy a DCN with the Splunk OVA for VMware Metrics or manually convert a heavy forwarder into a DCN.

After you deploy a DCN, configure data collection with a Data Collection Scheduler (DCS) from the Collection Configuration page in the Splunk Add-on for VMware Metrics. For information about setting up a DCS, see Deploy a Data Collection Scheduler with the Splunk Add-on for VMware Metrics.

Prerequisites

• You viewed the DCN requirements. See Data Collection Node requirements.
• The Data Collection Node for Splunk Add-on for VMware and Splunk Add-on for VMware Metrics cannot be the same instance. So, the instance on which you are deploying the Add-on package should not be the DCN of the Splunk Add-on for VMware already.

Deploy a DCN with the Splunk VMware OVA for VMware Metrics

Deploy the Splunk OVA for VMware Metrics in a vCenter Server. When you deploy the OVA, it creates a virtual machine running a Splunk heavy forwarder that's configured to be a DCN. For information about specifications for the OVA, see Install the Splunk OVA for VMware Metrics in the Splunk OVA for VMware Metrics manual.

Follow these steps to deploy the OVA and set up the DCN.

1. Deploy DCN with Splunk OVA for VMware Metrics

Download the Splunk OVA for VMware Metrics from Splunkbase.

2. Deploy the DCN in a vCenter Server

Use the OVA to create a virtual machine in your vCenter Server to run the DCN. For information about deploying an OVA, see Deploy an OVF or OVA Template on the VMware website.

For information about DCN requirements, see Data Collection Node requirements.

After you deploy the OVA, the vCenter Server automatically assigns an IP address to the DCN via DHCP. For the most reliable connection, configure a static IP address for the DCN if possible.

Follow these steps to set up the DCN after you deployed the OVA in a vCenter Server.

1. SSH into the virtual machine that's running the DCN.
2. Log in to the virtual machine as the root user:

   username: root
   password: changemenow
   

3. Change the password:

   # passwd
   

4. Run the dcn-network-config command to test the network configuration for the DCN. Press Enter for each setting you don't want to change. When you finish, the dcn-network-config command tests your network configuration. These are the settings you can modify:

   IPv4 address
   IPv4 address of the default gateway
   Netmask
   DNS/Nameserver
   Hostname
   

3. Configure the DCN

1. Log in to the virtual machine with these user credentials:

   username: splunk
   password: changeme
   

2. Run the dcn-splunk-config command and enter a new password for the admin user for the universal forwarder. Before you change the password for the admin user, the default password is changeme.
3. Configure these settings:

   Setting	Description
   Enter comma separated Indexers(<host>:<port>)[]	Enter the IP address and port of each indexer you want to forward data to. For more information about forwarding data directly to indexers, see Connect forwarders directly to peer nodes in the Splunk Enterprise Managing Indexers and Clusters of Indexers guide.
   Enter license master(https://<host>:<port>)[self]	You don't have to configure the DCN as a license slave to collect data from the VMware vCenter Server. Press Enter to continue without providing a license master.

4. Save your changes and restart Splunk.

Configure a heavy forwarder to be a DCN

Follow these steps to configure an existing heavy forwarder as a DCN. If you use a heavy forwarder that's performing other tasks, you may run into performance issues. For the best performance, configure a heavy forwarder to be a dedicated DCN, especially if you want to monitor vCenter Servers that are near or at the maximum number of ESXi hosts and virtual machines a DCN can manage. For information about DCN requirements and limits, see Data Collection Node requirements.

1. Install the add-ons

Install the following add-ons on the heavy forwarder. Download the following add-on from Splunkbase. To install the add-on, extract the add-on tgz packages to $SPLUNK_HOME/etc/apps.

Splunkbase name	Add-on	Description
Splunk Add-on for VMware Metrics	Splunk_TA_vmware_inframon SA-Hydra-inframon	Runs a Python-based API data collection engine and performs search-time tagging of VMware data. Runs worker processes to collect VMware data from vCenter Servers.
Splunk Add-on for VMware ESXi logs	Splunk_TA_esxilogs	Runs props and transforms for ESXi log data you forward to the DCN. If you don't forward ESXi log data to the DCN and instead forward ESXi log data directly to the indexer tier, you don't have to install this add-on on the DCN.
Splunk Add-on for vCenter logs	Splunk_TA_vcenter	Runs props and transforms for vCenter Server log data you forward to the DCN. If you don't forward vCenter Server log data to the DCN and instead forward vCenter Server log data directly to the indexer tier, you don't have to install this add-on on the DCN.

2. Configure forwarding

Configure the heavy forwarder to send data to your indexer or distributed indexer environment.

Follow these steps to configure forwarding:

1. Enable forwarding on the heavy forwarder. For information about deploying a heavy forwarder, see Set up forwarding in the Splunk Enterprise Forwarding Data guide.
2. Specify the indexer or group of indexers you want to forward data to. There are two options to do this:
   1. Manually specify each indexer you want to forward data to. For more information about forwarding data directly to indexers, see Connect forwarders directly to peer nodes in the Splunk Enterprise Managing Indexers and Clusters of Indexers guide.
   2. Configure indexer discovery to forward data to indexers. For information about how to use indexer discovery, see Use indexer discovery to connect forwarders to peer nodes.