Hardware and software requirements for the Splunk Add-on for VMware Metrics
Review the following requirements before you deploy Splunk Add-on for VMware Metrics.
Splunk platform version requirements
All of the system requirements for the Splunk platform apply for the Splunk software that you use to run this add-on.
- For Splunk Enterprise system requirements, see System requirements for use of Splunk Enterprise on-premises in the Splunk Enterprise Installation Manual.
- If you're managing on-premises forwarders to get data into Splunk Cloud, System requirements for use of Splunk Enterprise on-premises, which includes information about forwarders.
| Current add-on version | Supported versions of vCenter server | Supported versions of Splunk Enterprise |
|---|---|---|
| 4.3.0 |
|
|
Browser support
The Splunk Add-on for VMware Metrics supports the following browsers:
- Firefox (latest version)
- Safari (latest version)
- Chrome (latest version)
VMware indexes
| Index | Description |
|---|---|
| vmware-perf-metrics | Stores metrics data from a vCenter server. |
| vmware-inv | Stores inventory data from a vCenter Server. |
| vmware-taskevent | Stores task and event data from a vCenter Server. |
| vmware-vclog | Stores vCenter Server log data. |
| vmware-esxihost | Stores ESXi host log data. |
Data Collection Scheduler requirements
A DCS schedules jobs and manages DCNs that collect data from vCenter Servers. If you're deploying VMware data collection in a distributed search head environment, deploy a DCS on a dedicated Splunk Enterprise instance. You don't have to configure forwarding or receiving on the DCS. To deploy a DCS, see Deploy the Data Collection Scheduler.
Depending on your VMware vSphere environment, you may want to deploy more than one DCS.
These are the requirements to run a Data Collection Scheduler (DCS):
| Splunk Enterprise version | Operating system |
|---|---|
| 9.1.x | RHEL 9.2, Windows Server 2022 |
| 9.2.x | RHEL 9.2, Windows Server 2022 |
| 9.3.x | RHEL 9.2, Windows Server 2022 |
User account permissions
When you integrate a VMware vCenter Server on a DCS, you have to provide credentials for a user account associated with the vCenter Server on the DCS. The DCS uses the user account credentials to detect ESXi servers in the vCenter Server, and to poll metrics, task, event, and inventory data.
To collect vCenter performance metrics, the user account you provide on the DCS needs to have these permissions:
- System.Anonymous
- System.Read
- System.View
If you provide a user-defined role, it contains the System.Anonymous, System.Read, and System.View permissions even if you don't associate them with the role manually.
The following permissions are required to update the configuration and use Syslog Service on Esxi hosts:
- Global.Diagnostics
- Global.Licenses
- Global.Settings
- Host.Configuration.Change SNMP settings
- Host.Configuration.Hyperthreading
- Host.Configuration.Memory configuration
- Host.Configuration.Network configuration
- Host.Configuration.Power
- Host.Configuration.Security profile and firewall
- Host.Configuration.Storage partition configuration
- Sessions.View and stop sessions
Data Collection Node requirements
Each DCN runs worker processes to collect VMware data from vCenter servers. You can run N-1 worker processes, where N is the number of the DCNs available CPU cores. The DCN requires physical CPU cores, and can't benefit from simultaneous multithreading (SMT). Each worker process can manage 10 ESXi hosts and up to 30 virtual machines per host when collecting the default metrics. If the add-on is configured to collect all the metrics, a maximum of 10 VMs can be assigned to 1 ESXi host.
You can configure a maximum of 8 worker processes (WP) on 1 DCN. If more than 8 WP are required to monitor your infrastructure, you can set up multiple DCNs reports to the same DCS. Setting more than 8 WP on 1 DCN can lead to job expirations resulting in data loss.
| Configuration | Standard guideline per worker process |
|---|---|
| If the add-on collects default metrics (no change in any configuration) | 10 ESXi hosts and 30 VMs per ESXi host |
| If the add-on collects all metrics by configuring host_metric_allowlist and vm_metric_allowlist to .* in inframon_ta_vmware_template.conf
When you collect all metrics, the number of metrics and instances might change according to the vCenter Server configuration, so it might require more resources. |
10 ESXi hosts and 10 VMs per ESXi host |
The following are the Splunk platform and operating system requirements to run a DCN if you don't use the Splunk OVA for VMware Metrics. For more information, see About the Splunk OVA for VMware Metrics:
| Splunk Enterprise version | Operating system |
|---|---|
| 9.1.x | RHEL 9.2, Windows Server 2022 |
| 9.2.x | RHEL 9.2, Windows Server 2022 |
| 9.3.x | RHEL 9.2, Windows Server 2022 |
These are the maximum ESXi hosts and virtual machines a single DCN can manage with the minimum DCN requirements:
| ESXi host | Virtual machine |
|---|---|
| 70 | 1,750 |
Data volume requirements
In a typical environment, approximately 250 MB and 350 MB of data can be collected per host per day from your environment. This number varies depending on the volume of log data you collect, and the number of virtual machines that reside on a host. See the information below for further details.
| Data type | Data volume |
|---|---|
| vCenter Server logs | 15 MB per host per day |
| ESXi host logs | 135-235 MB per host per day |
| ESXi host API (Inventory) | 25 KB per host per day |
| ESXi host API (Performance) | 16 MB per host per day |
| VM API (Inventory) | 250 KB per VM per day |
| VM API (Performance) | 5 MB per VM per day |
These data volume readings are based on the default metrics collected by the add-on. The data volume increases based on metrics configuration in inframon_ta_vmware_template.conf.
Version compatibility
vCenter versions 5.x and 6.x are End of Life (EOL).
| Compatible Splunk Enterprise version | Compatible Splunk Add-on for VMware Metrics version | Compatible vCenter version | Compatible ESXi version | Compatible Splunk Add-on for VMware Metrics Indexes | Compatible Splunk Add-on for vCenter logs | Compatible Splunk Add-on for VMware ESXi logs |
|---|---|---|---|---|---|---|
| 7.2.x to 8.0.4 | 4.0.0 | 6.0, 6.5, 6.7 | 6.0, 6.5, 6.7 | 4.0.0 | 4.0.0 | 4.0.0 |
| 7.3.x to 8.1.0 | 4.1.0 | 6.0, 6.5, 6.7 | 6.0, 6.5, 6.7 | 4.1.0 | 4.1.0 | 4.1.0 |
| 7.3.x to 8.2.0 | 4.2.0 | 6.0, 6.5, 6.7, 7.0 | 6.0, 6.5, 6.7, 7.0 | 4.2.0 | 4.2.0 | 4.2.0 |
| 8.0.x to 8.2.0 | 4.2.1, 4.2.2 | 6.5, 6.7, 7.0 | 6.5, 6.7, 7.0 | 4.2.1 | 4.2.1 | 4.2.1 |
| 8.0.x to 8.2.x | 4.2.3 | 6.5, 6.7, 7.0 | 6.5, 6.7, 7.0 | 4.2.1 | 4.2.1 | 4.2.1 |
| 8.2.x to 9.1.x | 4.2.4 | 7.0, 8.0 | 7.0, 8.0 | 4.2.1 | 4.2.1 | 4.2.1 |
| 9.1.x to 9.3.x | 4.3.0 | 7.0, 8.0 | 7.0, 8.0 | 4.2.1 | 4.2.1 | 4.2.1 |
| Release history for Splunk Add-on for VMware Metrics | Installation and configuration overview for the Splunk Add-on for VMware Metrics |
This documentation applies to the following versions of Splunk® Supported Add-ons: released
Download manual
Feedback submitted, thanks!