About the VMware vSphere entity integration in ITSI
To collect VMware data in ITSI, you need to install the Splunk Add-on for VMware Metrics. The add-on uses a Data Collection Scheduler (DCS) to collect metrics. A DCS schedules data collection jobs for Data Collection Nodes (DCN). DCNs are modified heavy forwarders that collect data from a vCenter Server. You can deploy a DCN with the Splunk OVA for VMware Metrics or as a heavy forwarder that you modify manually. For more information about the OVA for VMware Metrics, see About the Splunk OVA for VMware Metrics. For more information about the VMware metrics add-on, see About the Splunk Add-on for VMware Metrics.
The VMware vSphere entity integration supports the following entity types:
- VMware Cluster
- VMware ESXi Host
- VMware vCenter
- VMware VM
- VMware Datastore (Additional configuration required. See Collect VMware datastore performance metrics.)
Install the add-on and data collection components
Before you can start configuring data collection for VMware vCenter servers, you have to install additional components in your environment, deploy a DCS, and deploy at least one DCN for each vCenter Server you want to monitor. A single DCS can schedule data collection jobs for multiple DCNs. For information about scaling DCNs for vCenter Servers, see Data Collection Node requirements. The easiest way to deploy a DCN is to use the OVA template. You can also modify a heavy forwarder to perform as a DCN.
You also need to confirm that the proper ports are available and open in your Splunk and vCenter Server environments. To view all the VMware data collection requirements, see Data collection planning and requirements for the Splunk Add-on for VMware Metrics.
View these topics to install the required components, deploy a DCN, and deploy a DCS:
- Installation and configuration overview for the Splunk Add-on for VMware Metrics
- Deploy a Data Collection Node with the Splunk Add-on for VMware Metrics
- Deploy a Data Collection Scheduler with the Splunk Add-on for VMware Metrics
For information about the sources the VMware add-on collects data from, as well as a list of the entities and default dimensions in the performance data, see Source types for the Splunk Add-on for VMware Metrics in the
After you deploy a DCN and a DCS, and deploy the Splunk Add-on for VMware Metrics on your indexers and search head, you can start configuring VMware vCenter Server integrations. For instructions, see Add configurations in the Collection Configuration page of the Splunk Add-on for VMware Metrics.
To collect VMware vCenter Server and ESXI host log data, performance metrics, inventory, and tasks, see Configure Splunk Add-on for VMware Metrics to collect data.
Collect VMware datastore performance metrics
ITSI contains a saved search that collects VMware datastore entities into ITSI, in contrast to other VMware entity types that are collected through the Splunk App for Infrastructure (SAI) backend. Therefore, in addition to installing and configuring the Splunk Add-on for VMware Metrics, you also need to enable the saved search in order for VMware datastore collection to work.
The VMware datastore integration requires the Splunk Add-on for VMware Metrics version 4.1.0 or later, which include the ability to ingest performance data for VMware datastore metrics into the metrics index. For upgrade steps, see Upgrade the Splunk Add-on for VMware Metrics.
Perform the following steps to collect VMware datastore data in ITSI:
- Install the Splunk Add-on for VMware Metrics version 4.1.0 or later as described in the previous section.
- On the ITSI search head, go to Settings > Searches, reports, and alerts.
- Change the Owner to All.
- Locate the search named ITSI Import Objects - VMware Datastore.
- In the Actions column, click Edit > Enable to enable the search.
- Navigate back to the entities lister page in ITSI and confirm your datastore entities show up and have the entity type
Removal of the VMware Add-on for ITSI
The VMware Add-on for ITSI, which was used to collect VMware performance data in SAI version 2.1.x, was removed from the ITSI package in version 4.6.0. To collect VMware data in SAI version 2.2.0 and higher, you need to use the Splunk Add-on for VMware Metrics. If you were already collecting VMware data in a previous SAI version, you need to upgrade to the Splunk Add-on for VMware Metrics. For more information, see About VMware vSphere integrations in SAI. The VMware data collection component configuration has been removed from SAI and now exists in the Splunk Add-on for VMware Metrics.
For a compatibility matrix showing different versions of SAI with various VMware products, see SAI compatibility with VMware apps and add-ons.
If you have problems setting up the VMware entity integration, see Troubleshoot the VMware vSphere entity integration in ITSI.
Troubleshoot the Windows entity integration in ITSI
Troubleshoot the VMware vSphere entity integration in ITSI
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.7.0, 4.7.1, 4.7.2, 4.8.0 Cloud only, 4.8.1 Cloud only, 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.10.0 Cloud only, 4.10.1 Cloud only, 4.10.2 Cloud only