Deploy a Data Collection Scheduler with the Splunk Add-on for VMware Metrics

Deploy a Data Collection Scheduler (DCS) to integrate VMware vSphere vCenter Servers and manage each Data Collection Node (DCN) you deploy. A DCS schedules jobs and manages DCNs that collect data from vCenter Servers. There are a few places to deploy the DCS:

• You can modify a Data Collection Node (DCN) to also act as a DCS.
• If you're running a single-instance search head environment, you can deploy the DCS on the search head.
• If you're running a distributed search head environment, you can deploy the DCS on a dedicated Splunk Enterprise instance or modify a DCN to also act as a DCS.

When you integrate a VMware vCenter Server on a DCS, you have to provide credentials for a user account associated with the vCenter Server on the DCS. For information about user account requirements, including the permissions the user account needs to have, see User account permissions.

Prerequisites

• You viewed the DCS requirements. See Data Collection Scheduler requirements.
• You have an available Splunk Enterprise instance running RHEL 9 or Windows Server 2022.

Steps

Follow these steps to deploy a DCS.

1. Install the add-on

Download the Splunk Add-on for VMware Metrics package from Splunkbase and add the following packages to $SPLUNK_HOME/etc/apps:

Add-on	Description
Splunk_TA_vmware_inframon	Runs a Python-based API data collection engine and performs search-time tagging of VMware data. It is also used in configuration of the add-on.
SA-Hydra-inframon	Generates the data collection jobs as per the add-on configuration and assigns the jobs to DCN.

2. Start integrating VMware vCenter Servers and manage DCNs

Integrate Data Collection Nodes (DCNs) and vCenter Servers on a DCS. If you have multiple DCSs, you have to integrate a DCN and vCenter with the same DCS. For example, if you deployed 3 DCSs to manage VMware data collection, and you configured DCN A to collect data from vCenter B, use DCS 1 to manage DCN A and integrate vCenter B.

If you haven't deployed a DCN yet, do that now. For more information, see Deploy a Data Collection Node with the Splunk Add-on for VMware Metrics.

To integrate a vCenter, see Add configurations in the Collection Configuration page of the Splunk Add-on for VMware Metrics.

Change default collection intervals

After you deploy the DCN, you can modify default collection intervals. Change collection intervals to reduce the load on your Data Collection Nodes (DCNs) and your vCenter Servers. First change the time interval for host inventory jobs, then change the time interval for host performance data. The unit of time for collection intervals is seconds.

1. On the instance that runs the DCS, go to $SPLUNK_HOME/etc/apps/Splunk_TA_vmware_inframon/local.
2. Open the inframon_ta_vmware_pool.conf file. If the file doesn't exist yet, create it now.
3. In the [Global pool] stanza, change the hostinv_interval and hostinv_expiration values. If the [Global pool] stanza doesn't exist, create it.
4. Changes values for hostinv_interval and hostinv_expiration. These setting have to have the same values. The maximum value is 2700.
5. Change values for hostvmperf_interval and hostvmperf_expiration. These settings have to have the same values. The maximum value is 1200.
6. Save your changes and exit.