Add configurations in the Collection Configuration page of the Splunk Add-on for VMware Metrics

Configure VMware vCenter Server integrations with a Data Collection Scheduler (DCS) to collect metrics. A DCS schedules data collection jobs for Data Collection Nodes (DCN). DCNs are modified heavy forwarders that collect data from a vCenter Server. You can deploy a DCN with the Splunk OVA for VMware Metrics or as a heavy forwarder that you modify manually.

Before you can start configuring data collection for VMware vCenter Servers, you have to install additional components in your environment, deploy a DCS, and deploy at least one DCN for each vCenter Server you want to monitor. A single DCS can schedule data collection jobs for multiple DCNs. For information about scaling DCNs for vCenter Servers, see Data Collection Node requirements. The easiest way to deploy a DCN is to use the OVA template. You can also modify a heavy forwarder to perform as a DCN.

You also need to confirm that the proper ports are available and open in your Splunk and vCenter Server environments. To view all the VMware data collection requirements, see Data collection planning and requirements for the Splunk Add-on for VMware Metrics.

Prerequisites

• You deployed a DCN. For more information, see Deploy a Data Collection Node with the Splunk Add-on for VMware Metrics.
• You deployed a DCS. For more information, see Deploy a Data Collection Scheduler with the Splunk Add-on for VMware Metrics.
• You deployed an indexer. For more information, see Deploy the Splunk Add-on for VMware Metrics on your indexers.
• The user has to have admin role in order to see or update the configuration shown in the Collection Configuration page. The following text is displayed if the Splunk user does not have admin role and the user opens the Collection Configuration page from the Splunk Add-on for VMware Metrics:
  You must be assigned admin role to use Collection Configuration page. Please contact to your Splunk administrator.

Integrate a vCenter server

Follow these steps to start collecting data from a vCenter Server. You have to integrate a vCenter Server on a DCS. Go to the Collection Configuration page of Splunk Add-on for VMware Metrics:

Select the vCenter tab and click Add vCenter.

Step 1: Add vCenter credentials

Specify the vCenter Server you want to integrate, and include admin user credentials so that SAI can connect to the vCenter Server.

Configure the following settings:

Field	Description
Virtual Center FQDN	The fully qualified domain name (FQDN) of the vCenter Server you want to integrate.
Virtual Center Username	The name of an admin user for the vCenter Server. If the user is an Active Directory account, use the username@domain format.
Virtual Center Password	The password for the admin user.

Step 2: Configure data collection

By default, you collect data from every ESXi host and virtual machine. To select a subset of ESXi hosts, disable Collect data from all hosts to allow or block specific ESXi hosts. Use a regular expression to capture ESXi hosts you want to allow or block.

Allowing an ESXi host or set of ESXi hosts automatically blocks every ESXi host the regular expression doesn't capture. Similarly, blocking an ESXi host or set of ESXi hosts automatically allows every ESXi host the regular expression doesn't capture.

Step 3: Save the configuration

When you're done, click Save to submit the integration.

It can take about 5-10 minutes before you start seeing the vCenter and every cluster, ESXi host, and virtual machine, especially if you're integrating a larger VMware environment.

Bulk upload vCenter servers

You can upload a CSV file that contains credentials for multiple vCenter Servers to integrate more than one vCenter Server at a time. There's no limit to how many vCenter Servers you can upload in a single bulk upload. All passwords are encrypted when you submit the bulk upload.

The CSV file must be a table that looks like this:

FQDN	Username	Password
example1.com	username1	buttercup123
example2.com	username2	buttercup456

Follow these steps to bulk upload vCenter servers.

1. Go to the Collection Configuration page from Splunk Add-on for VMware Metrics.
2. Select the vCenter tab and click Add vCenter.
3. Under Integrate multiple vCenter Servers in a bulk upload, click Download the CSV template to view an example of what the CSV file needs to look like.
4. Upload the CSV file that contains credentials for each vCenter Server you want to integrate.
5. Review the credentials and click Save to submit the bulk upload.

Integrate a DCN

Follow these steps to integrate a DCN you deployed to collect VMware vCenter Server data. When you integrate a DCN, a DCS starts scheduling jobs for the DCN to collect VMware vCenter Server data. You have to integrate a DCN on a DCS. Go to Collection Configuration page in Splunk Add-on for VMware Metrics.

First, select the DCN tab and click Add DCN.

Enter the heavy forwarder credentials

Specify the DCN you want to integrate, and select how many worker processes the DCN runs. A worker process runs on the DCN to collect VMware data. For more information about worker processes, see Data Collection Node requirements and limits in the Installation and Configuration guide.

Configure these settings:

Setting	Description
Splunk Forwarder URI	Enter the hostname or IP address and management port of the heavy forwarder that runs the DCN. By default, the management port is 8089. For example, https://<host_name_or_ip_address_of_DCN>:8089.
Splunk Forwarder Username	Enter the name of an admin user for the heavy forwarder that runs the DCN.
Splunk Forwarder Password	Enter the password for the admin user.
Worker processes	Select how many worker processes you want to run on the DCN. You can run up to 8 worker processes on each DCN, depending on how many CPU cores you allocated to the DCN. The number of worker processes must be one fewer than the number of CPU cores the vCenter server system granted to the DCN. For example, if the DCN has four CPU cores, the number of worker processes is three. Each worker process can manage 10 ESXi hosts and up to 30 virtual machines per host when collecting the default metrics. If the add-on is configured to collect all the metrics, a maximum of 10 VMs can be assigned to 1 ESXi host.

You can configure a maximum of 8 worker processes (WP) on 1 DCN. If more than 8 WP are required to monitor your infrastructure, you can set up multiple DCNs reports to the same DCS. Setting more than 8 WP on 1 DCN can lead to job expirations resulting in data loss.

When you're done, click Save to submit the integration.

Bulk upload DCNs

You can upload a CSV file that contains credentials for multiple DCNs to integrate more than one DCN on a DCS at a time. There's no limit to how many vCenter Servers you can upload in a single bulk upload. All passwords are encrypted when you submit the bulk upload.

The CSV file must be a table that looks like this:

FQDN	Username	Password	Worker processes
example1.com	username1	buttercup123	4
example2.com	username2	buttercup456	8

Follow these steps to bulk upload DCNs:

1. Open the Collection Configuration page of Splunk Add-on for VMware Metrics
2. Select the DCN tab and click Add DCN.
3. Under (Optional) CSV Bulk Upload, click Download the CSV template to view an example of what the CSV file needs to look like.
4. Upload the CSV file that contains credentials for each DCN you want to integrate.
5. Review the credentials and click Save to submit the bulk upload.

Start the data collection

1. Go to the Collection Configuration page of the Splunk Add-on for VMware Metrics.
2. Go to the DCN tab.
3. Toggle Enable data collection.

It can take about 5-10 minutes before the DCS starts scheduling jobs for the DCN.

Test DCN and vCenter server configurations

It can take up to about 10 minutes after you start the DCS to collect data from DCNs. When you should be receiving data from a DCN, go to the search head and run a search to confirm whether you're receiving data.

You can run this search to confirm whether you're receiving metrics in the vmware-perf-metrics index:

|mstats latest(_value) where metric_name=* AND index=vmware-perf-metrics by metric_name