Deploy a Data Collection Node with the Splunk Add-on for VMware Metrics
Deploy a Data Collection Node (DCN) to collect data from VMware vSphere vCenter Servers. You can deploy a DCN with the Splunk OVA for VMware Metrics or manually convert a heavy forwarder into a DCN.
After you deploy a DCN, configure data collection with a Data Collection Scheduler (DCS) from the Collection Configuration page in the Splunk Add-on for VMware Metrics. For information about setting up a DCS, see Deploy a Data Collection Scheduler with the Splunk Add-on for VMware Metrics.
- You viewed the DCN requirements. See Data Collection Node requirements.
- The Data Collection Node for Splunk Add-on for VMware and Splunk Add-on for VMware Metrics cannot be the same instance. So, the instance on which you are deploying the Add-on package should not be the DCN of the Splunk Add-on for VMware already.
Deploy a DCN with the Splunk VMware OVA for VMware Metrics
Deploy the Splunk OVA for VMware Metrics in a vCenter Server. When you deploy the OVA, it creates a virtual machine running a Splunk heavy forwarder that's configured to be a DCN. For information about specifications for the OVA, see Install the Splunk OVA for VMware Metrics in the Splunk OVA for VMware Metrics manual.
Follow these steps to deploy the OVA and set up the DCN.
1. Deploy DCN with Splunk OVA for VMware Metrics
Download the Splunk OVA for VMware Metrics from Splunkbase.
2. Deploy the DCN in a vCenter Server
Use the OVA to create a virtual machine in your vCenter Server to run the DCN. For information about deploying an OVA, see Deploy an OVF or OVA Template on the VMware website.
For information about DCN requirements, see Data Collection Node requirements.
After you deploy the OVA, the vCenter Server automatically assigns an IP address to the DCN via DHCP. For the most reliable connection, configure a static IP address for the DCN if possible.
Follow these steps to set up the DCN after you deployed the OVA in a vCenter Server.
- SSH into the virtual machine that's running the DCN.
- Log in to the virtual machine as the root user:
username: root password: changemenow
- Change the password:
- Run the
dcn-network-configcommand to test the network configuration for the DCN. Press
Enterfor each setting you don't want to change. When you finish, the
dcn-network-configcommand tests your network configuration. These are the settings you can modify:
IPv4 address IPv4 address of the default gateway Netmask DNS/Nameserver Hostname
3. Configure the DCN
- Log in to the virtual machine with these user credentials:
username: splunk password: changeme
- Run the
dcn-splunk-configcommand and enter a new password for the
adminuser for the universal forwarder. Before you change the password for the
adminuser, the default password is
- Configure these settings:
Enter comma separated Indexers(<host>:<port>)
Enter the IP address and port of each indexer you want to forward data to. For more information about forwarding data directly to indexers, see Connect forwarders directly to peer nodes in the Splunk Enterprise Managing Indexers and Clusters of Indexers guide.
Enter license master(https://<host>:<port>)[self]
You don't have to configure the DCN as a license slave to collect data from the VMware vCenter Server. Press Enter to continue without providing a license master.
- Save your changes and restart Splunk.
Configure a heavy forwarder to be a DCN
Follow these steps to configure an existing heavy forwarder as a DCN. If you use a heavy forwarder that's performing other tasks, you may run into performance issues. For the best performance, configure a heavy forwarder to be a dedicated DCN, especially if you want to monitor vCenter Servers that are near or at the maximum number of ESXi hosts and virtual machines a DCN can manage. For information about DCN requirements and limits, see Data Collection Node requirements.
1. Install the add-ons
Install the following add-ons on the heavy forwarder. Download the following add-on from Splunkbase. To install the add-on, extract the add-on tgz packages to
|Splunk Add-on for VMware Metrics||
|Splunk Add-on for VMware ESXi logs||Splunk_TA_esxilogs||Runs props and transforms for ESXi log data you forward to the DCN. If you don't forward ESXi log data to the DCN and instead forward ESXi log data directly to the indexer tier, you don't have to install this add-on on the DCN.|
|Splunk Add-on for vCenter logs||Splunk_TA_vcenter||Runs props and transforms for vCenter Server log data you forward to the DCN. If you don't forward vCenter Server log data to the DCN and instead forward vCenter Server log data directly to the indexer tier, you don't have to install this add-on on the DCN.|
2. Configure forwarding
Configure the heavy forwarder to send data to your indexer or distributed indexer environment.
Follow these steps to configure forwarding:
- Enable forwarding on the heavy forwarder. For information about deploying a heavy forwarder, see Set up forwarding in the Splunk Enterprise Forwarding Data guide.
- Specify the indexer or group of indexers you want to forward data to. There are two options to do this:
- Manually specify each indexer you want to forward data to. For more information about forwarding data directly to indexers, see Connect forwarders directly to peer nodes in the Splunk Enterprise Managing Indexers and Clusters of Indexers guide.
- Configure indexer discovery to forward data to indexers. For information about how to use indexer discovery, see Use indexer discovery to connect forwarders to peer nodes.
Set up your system for the Splunk Add-on for VMware Metrics
Deploy a Data Collection Scheduler with the Splunk Add-on for VMware Metrics
This documentation applies to the following versions of Splunk® Supported Add-ons: released