Install and configure the Content Pack for VMware Dashboards and Reports

Perform the following high-level steps to install and configure the Content Pack for VMware Dashboards and Reports:

1. Install and configure Splunk Add-on for VMware Metrics.
2. Install the content pack.
3. Enable data model acceleration.

Prerequisites

• Install and configure the IT Service Intelligence (ITSI) or IT Essentials Work (ITE Work) in your environment. See About Splunk ITSI in the Install and Upgrade Manual, or Install IT Essentials Work in the Overview of Splunk IT Essentials Work manual.
• The Content Pack for VMware Dashboards and Reports integrates with a vCenter Server and the hypervisors it manages. Use a supported version of VMware vCenter Server to manage hypervisors:
  • Environments with Windows-based vCenter and/or Linux-based vCenter Server Appliance are supported.
  • ESXi servers that are not managed through vCenter are not supported.

Install and configure the Splunk Add-on for VMware Metrics

The content pack depends on data collected by the Splunk Add-on for VMware Metrics. You can configure the Splunk Add-on for VMware Metrics by deploying it on the required components.

You can also create the DCN machine by deploying Splunk OVA for VMware Metrics in the virtualization environment.

• See Deploy a Data Collection Node with the Splunk Add-on for VMware Metrics.
• See Deploy a Data Collection Scheduler with the Splunk Add-on for VMware Metrics.

The following table shows the installation locations for the add-on components:

Package	Component	Search head	Indexer	Scheduler	Data Collection Node (DCN)
Splunk Add-on for VMware Metrics	Splunk_TA_VMware_inframon			x	x
	SA-Hydra-inframon			x	x
	SA-VMWIndex-inframon		x
	Splunk_TA_esxilogs	x	x
	Splunk_TA_vcenter	x	x

The Splunk_TA_esxilogs and Splunk_TA_vcenter packages are not used in the Content Pack for VMware Dashboards and Reports.

(Optional) Update the index search macro with custom index

To use custom indexes, update the index search macros shipped with the content packs.

Prerequisites

• You should have the admin role to update the index search macro.
• You should know which indexes your organization uses to send data from the Add-on to your Splunk platform deployment.

Steps

1. From Splunk Web, select Settings > Advanced Search > Search Macros.

2. Configure the custom index as per requirements as outlined in the following table:

Macro Name	Index Type	Default Macro Definition	Macro Definition with Custom Index
vmwareperf-metrics-index	Metrics	index=vmware-perf-metrics	All of the indexes that you're using for data collection from add-ons combined with OR operators. For example: index=vmware-perf-metrics OR index=<index-name>
vmwareinv-index	Events	index=vmware-inv	All of the indexes that you're using for data collection from add-ons combined with OR operators. For example: index=vmwareinv OR index=<index-name>
vmwaretaskevent-index	Events	index=vmware-taskevent	All of the indexes that you're using for data collection from add-ons combined with OR operators. For example: index=vmwaretaskevent OR index=<index-name>
vmwarevclog-index	Events	index=vmware-vclog	All of the indexes that you're using for data collection from add-ons combined with OR operators. For example: index=vmwarevclog OR index=<index-name>
vmwareesxilog-index	Events	index=vmware-esxilog	All of the indexes that you're using for data collection from add-ons combined with OR operators. For example: index=vmwareesxilog OR index=<index-name>

3. Select Save.

Install the content pack

To install the Content Pack for VMware Dashboards and Reports, you have to install the Splunk App for Content Packs. To install the Splunk App for Content Packs in your environment, see the Splunk App for Content Packs installation instructions.

The content pack contents are automatically installed and start running when you install the Splunk App for Content Packs on the search head where you installed ITSI or IT Essentials Work.

After you install the Splunk App for Content Packs, follow these steps to configure the Content Pack for VMware Dashboards and Reports:

1. From the ITSI or ITE Work main navigation bar, click Configuration > Data Integrations.
2. Select Content Library.
3. Select the VMware Dashboards and Reports content pack.
4. Click Proceed.
5. Configure the content pack settings (saved search settings are described in the following table).
6. Click the Activate/Deactivate all saved searches button to modify status of saved searches of the Content Pack for VMware Dashboards and Reports.
7. Click on Install to confirm. Once done, you can view the status of the saved searches. The tile shows the current status of all the saved searches of the content pack.

Setting

Description

Modify status of saved searches

By default, saved searches included in a content pack are in deactivated state. Within this configuration, you have the flexibility to perform the following operations. Activate all saved searches: By selecting this option, you can activate all the saved searches associated with the content pack. Deactivate all saved searches: By selecting this option, you can deactivate all the saved searches associated with the content pack. Retain current status of saved searches: This option allows you to preserve the existing status of the saved searches within the content pack.

Enable data model acceleration

The acceleration of the data models "VMwareInventory" is disabled by default. Enable acceleration for this data model to populate the data on dashboards packaged in the content pack. You must be an admin to enable data acceleration or change the acceleration period. Complete the following steps on the search head to enable the acceleration of the VMwareInventory data model:

1. In Splunk Web, go to Settings > Data Models.
2. From the App list, select IT Service Intelligence (ITSI) or IT Essentials Work or to see the data models defined and used by the content pack.
3. Click Edit next to the data model you want to enable acceleration for.
4. Select Edit Acceleration.
5. Check Accelerate.
6. Select the summary range to specify the acceleration period. The default summary range is 1 month.
7. Click Save.

Next step

The Splunk Add-on for VMware Metrics collects limited performance metrics and inventory fields using the default configuration. There are additional available performance metrics and inventory fields that you must enable in order to display data in all dashboard panels. To see the dashboard metric list and inventory fields and to learn the steps to configure additional metrics and fields, see Configure Data Collection for Content Pack for VMware Dashboards and Reports .