Installation and configuration overview for the Splunk Add-on for VMware
The Splunk Add-on for VMware package contains the following components:
- SA-Hydra - Collects API based data from vCenter. It schedules jobs from the Search Head and runs the worker processes on each data collection node.
- Splunk_TA_vmware - Contains the python based API data collection engine and collects data from VMWare environment. Also provides search-time tagging of VMware data.
- Splunk_TA_esxilogs - Collects log data from your ESXi log hosts.
- Splunk_TA_vcenter - Collects vCenter data via API calls and forwards it to the indexers in your environment.
- SA-VMWIndex - Contains all the indexes required for VMware App.
- TA-VMW-FieldExtractions - Contains search time knowledge objects required for VMware App and ITSI Virtualization module.
The Splunk Add-on for VMware contains the following functions:
- Scheduler - Previously held by the Splunk App for VMware, the scheduler performs job distribution and load balancing for your distributed Splunk platform deployment.
- Python script
splunk_for_vmware_setup.pythat collects DCN details, such as DCN URI, username, and password information from the Collection Configuration page of the Splunk Add-on for VMware and sends them to SA-Hydra.
The below image outlines a full installation of the Splunk Add-on for VMware on a distributed deployment.
Deployment of the Splunk Add-on for VMware
See the table below to see which component goes on which part of your Splunk deployment.
|Component||Search head||Scheduler (DCS)||Indexer||Data Collection Node (DCN)||Dedicated ESXi log forwarder||Dedicated vCenter log forwarder|
(*)Depending on your specific configuration, you might also need Splunk_TA_vcenter to collect VCenter data.
As of vCenter 6.0 installing a forwarder on your vCenter server for log forwarding is not recommending as a best practice for VMWare. Forwarding vCenter application logs to syslog, an intermediate forwarder, or directly to a Splunk indexer is supported for 6.x versions of vCenter server.
Hardware and software requirements for the Splunk Add-on for VMware
Set up your system for the Splunk Add-on for VMware
This documentation applies to the following versions of Splunk® Supported Add-ons: released