Content Pack for VMware Dashboards and Reports

Content Pack for VMware Dashboards and Reports

Install and configure the Content Pack for VMware Dashboards and Reports

Perform the following high-level steps to install and configure the Content Pack for VMware Dashboards and Reports:

  1. Install and configure Splunk Add-on for VMware Metrics.
  2. Install the content pack.
  3. Enable data model acceleration.

Prerequisites

  • Install and configure the IT Service Intelligence (ITSI) or IT Essentials Work (ITE Work) in your environment. See About Splunk ITSI in the Install and Upgrade Manual, or Install IT Essentials Work in the Overview of Splunk IT Essentials Work manual.
  • The Content Pack for VMware Dashboards and Reports integrates with a vCenter Server and the hypervisors it manages. Use a supported version of VMware vCenter Server to manage hypervisors:
    • Environments with Windows-based vCenter and/or Linux-based vCenter Server Appliance are supported.
    • ESXi servers that are not managed through vCenter are not supported.

Install and configure the Splunk Add-on for VMware Metrics

The content pack depends on data collected by the Splunk Add-on for VMware Metrics. You can configure the Splunk Add-on for VMware Metrics by deploying it on the required components.

You can also create the DCN machine by deploying Splunk OVA for VMware Metrics in the virtualization environment.

The following table shows the installation locations for the add-on components:

Package Component Search head Indexer Scheduler Data Collection Node (DCN)
Splunk Add-on for VMware Metrics Splunk_TA_VMware_inframon x x
SA-Hydra-inframon x x
SA-VMWIndex-inframon x
Splunk_TA_esxilogs x x
Splunk_TA_vcenter x x

The Splunk_TA_esxilogs and Splunk_TA_vcenter packages are not used in the Content Pack for VMware Dashboards and Reports.

(Optional) Update the index search macro with custom index

To use custom indexes, update the index search macros shipped with the content packs.

Prerequisites

  • You should have the admin role to update the index search macro.
  • You should know which indexes your organization uses to send data from the Add-on to your Splunk platform deployment.

Steps

1. From Splunk Web, select Settings > Advanced Search > Search Macros.

2. Configure the custom index as per requirements as outlined in the following table:

Macro Name Index Type Default Macro Definition Macro Definition with Custom Index
vmwareperf-metrics-index Metrics index=vmware-perf-metrics All of the indexes that you're using for data collection from add-ons combined with OR operators.


For example:
index=vmware-perf-metrics OR index=<index-name>

vmwareinv-index Events index=vmware-inv All of the indexes that you're using for data collection from add-ons combined with OR operators.


For example:
index=vmwareinv OR index=<index-name>

vmwaretaskevent-index Events index=vmware-taskevent All of the indexes that you're using for data collection from add-ons combined with OR operators.


For example:
index=vmwaretaskevent OR index=<index-name>

vmwarevclog-index Events index=vmware-vclog All of the indexes that you're using for data collection from add-ons combined with OR operators.


For example:
index=vmwarevclog OR index=<index-name>

vmwareesxilog-index Events index=vmware-esxilog All of the indexes that you're using for data collection from add-ons combined with OR operators.


For example:
index=vmwareesxilog OR index=<index-name>

3. Select Save.

Install the content pack

To install the Content Pack for VMware Dashboards and Reports, you have to install the Splunk App for Content Packs. To install the Splunk App for Content Packs in your environment, see the Splunk App for Content Packs installation instructions.

The content pack contents are automatically installed and start running when you install the Splunk App for Content Packs on the search head where you installed ITSI or IT Essentials Work.

After you install the Splunk App for Content Packs, follow these steps to configure the Content Pack for VMware Dashboards and Reports:

  1. From the ITSI or ITE Work main navigation bar, click Configuration > Data Integrations.
  2. Select Content Library.
  3. Select the VMware Dashboards and Reports content pack.
  4. Click Proceed.
  5. Configure the content pack settings (saved search settings are described in the following table).
  6. Click the Activate/Deactivate all saved searches button to modify status of saved searches of the Content Pack for VMware Dashboards and Reports.
  7. Click on Install to confirm. Once done, you can view the status of the saved searches. The tile shows the current status of all the saved searches of the content pack.
Setting Description
Modify status of saved searches By default, saved searches included in a content pack are in deactivated state. Within this configuration, you have the flexibility to perform the following operations.
  • Activate all saved searches: By selecting this option, you can activate all the saved searches associated with the content pack.
  • Deactivate all saved searches: By selecting this option, you can deactivate all the saved searches associated with the content pack.
  • Retain current status of saved searches: This option allows you to preserve the existing status of the saved searches within the content pack.

Enable data model acceleration

The acceleration of the data models "VMwareInventory" is disabled by default. Enable acceleration for this data model to populate the data on dashboards packaged in the content pack. You must be an admin to enable data acceleration or change the acceleration period. Complete the following steps on the search head to enable the acceleration of the VMwareInventory data model:

  1. In Splunk Web, go to Settings > Data Models.
  2. From the App list, select IT Service Intelligence (ITSI) or IT Essentials Work or to see the data models defined and used by the content pack.
  3. Click Edit next to the data model you want to enable acceleration for.
  4. Select Edit Acceleration.
  5. Check Accelerate.
  6. Select the summary range to specify the acceleration period. The default summary range is 1 month.
  7. Click Save.

Next step

The Splunk Add-on for VMware Metrics collects limited performance metrics and inventory fields using the default configuration. There are additional available performance metrics and inventory fields that you must enable in order to display data in all dashboard panels. To see the dashboard metric list and inventory fields and to learn the steps to configure additional metrics and fields, see Configure Data Collection for Content Pack for VMware Dashboards and Reports .

Last modified on 03 June, 2024
Release Notes for the Content Pack for VMware Dashboards and Reports   Configure data collection for the Content Pack for VMware Dashboards and Reports

This documentation applies to the following versions of Content Pack for VMware Dashboards and Reports: 1.3.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters