Splunk® App for Infrastructure (Legacy)

Administer Splunk App for Infrastructure

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of Splunk® App for Infrastructure (Legacy). For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Collect VMware vCenter Server metrics with Splunk App for Infrastructure

Configure VMware vCenter Server integrations with a Data Collection Scheduler (DCS) to collect metrics. A DCS schedules data collection jobs for Data Collection Nodes (DCN). DCNs are modified heavy forwarders that collect data from a vCenter Server. You can deploy a DCN with the Splunk VMware OVA for ITSI or as a heavy forwarder that you modify manually. SAI doesn't discover a DCN as an entity when you integrate it with a DCS, but if you're running the DCN as a virtual machine in a vCenter Server you're integrating, you can monitor the DCN that way. If you deploy the DCN on a Linux system, you can also configure a Linux integration for it.

Before you can start configuring data collection for VMware vCenter Servers, you have to install additional components in your environment, deploy a DCS, and deploy at least one DCN for each vCenter Server you want to monitor. A single DCS can schedule data collection jobs for multiple DCNs. For information about scaling DCNs for vCenter Servers, see Data Collection Node requirements and limits in the Install and Upgrade Splunk App for Infrastructure guide. The easiest way to deploy a DCN is to use the OVA template. You can also modify a heavy forwarder to perform as a DCN.

You also need to confirm that the proper ports are available and open in your Splunk and vCenter Server environments. To view all the VMware data collection requirements, see VMware data collection planning and requirements in the Install and Upgrade Splunk App for Infrastructure guide.

View these topics in the Install and Upgrade Splunk App for Infrastructure guide to install the required components, deploy a DCN, and deploy a DCS if you haven't already:

Start collecting these types of data when you integrate a vCenter Server on a DCS:

  • Metrics
  • Task
  • Inventory
  • Event

DCNs send data to the vmware-perf-metrics metrics index.

To configure vCenter and ESXi host log data collection, see Collect VMware vCenter Server and ESXi host log data with Splunk App for Infrastructure.

You discover these entities and default dimensions when you integrate a vCenter Server:

Entity Dimensions
vCenter
  • entity_type
  • host
  • instance
  • moid
  • pool_name
  • vcenter
  • vmware_metric_aggregation
ESXi Cluster
  • entity_type
  • host
  • instance
  • moid
  • pool_name
  • vcenter
  • vmware_metric_aggregation
ESXi host
  • cluster
  • cluster_name
  • datastore
  • entity_type
  • host
  • ip
  • moid
  • name
  • os
  • os_version
  • pool_name
  • uuid
  • vcenter
Virtual machine
  • cluster
  • cluster_name
  • datastore
  • entity_type
  • host
  • hypervisor
  • hypervisor_name
  • ip
  • moid
  • name
  • os
  • os_version
  • pool_name
  • resourcepool
  • uuid
  • vcenter

Prerequisites

Integrate a vCenter Server

Follow these steps to start collecting data from a vCenter Server. You have to integrate a vCenter Server on a DCS. Don't try to integrate a vCenter Server on a search head that hasn't been set up as a DCS. Go to the Add Data page in SAI:

  1. In the SAI user interface, click the Add Data tab.
  2. Select VMware vSphere in the integration panel.
  3. Select the vCenter tab and click Add vCenter.

1. Add vCenter credentials

Specify the vCenter Server you want to integrate, and include admin user credentials so that SAI can connect to the vCenter Server.

Configure these settings:

Setting Description
Domain name Enter the fully qualified domain name (FQDN) of the vCenter Server you want to integrate.
Username Enter the name of an admin user for the vCenter Server. If the user is an Active Directory account, use the username@domain format.
Password Enter the password for the admin user.

2. Configure data collection

By default, you collect data from every ESXi host and virtual machine. To select a subset of ESXi hosts, disable Collect data from all hosts to allow or block specific ESXi hosts. Use a regular expression to capture ESXi hosts you want to allow or block.

Allowing an ESXi host or set of ESXi hosts automatically blocks every ESXi host the regular expression doesn't capture. Similarly, blocking an ESXi host or set of ESXi hosts automatically allows every ESXi host the regular expression doesn't capture.

3. Save the configuration

When you're done, click Save to submit the integration.

It can take about 5-10 minutes before you start seeing the vCenter and every cluster, ESXi host, and virtual machine, especially if you're integrating a larger VMware environment.

Bulk upload vCenter Servers

You can upload a CSV file that contains credentials for multiple vCenter Servers to integrate more than one vCenter Server at a time. There's no limit to how many vCenter Servers you can upload in a single bulk upload. All passwords are encrypted when you submit the bulk upload.

The CSV file must be a table that looks like this:

FQDN Username Password
example1.com username1 buttercup123
example2.com username2 buttercup456

Follow these steps to bulk upload vCenter Servers.

  1. In the SAI user interface, click the Add Data tab.
  2. Select VMware vSphere in the integration panel.
  3. Select the vCenter tab and click Add vCenter.
  4. Under Integrate multiple vCenter Servers in a bulk upload, click Download the CSV template to view an example of what the CSV file needs to look like.
  5. Upload the CSV file that contains credentials for each vCenter Server you want to integrate.
  6. Review the credentials and click Save to submit the bulk upload.

Integrate a DCN

Follow these steps to integrate a DCN you deployed to collect VMware vCenter Server data. When you integrate a DCN, a DCS starts scheduling jobs for the DCN to collect VMware vCenter Server data. You have to integrate a DCN on a DCS. Don't try to integrate a DCN on a search head that hasn't been set up as a DCS. Go to the Add Data page in SAI:

  1. In the SAI user interface, click the Add Data tab.
  2. Select VMware vSphere in the integration panel.
  3. Select the DCN tab and click Add DCN.

1. Enter the heavy forwarder credentials

Specify the DCN you want to integrate, and select how many worker processes the DCN runs. A worker process runs on the DCN to collect VMware data. For more information about worker processes, see Data Collection Node requirements and limits in the Install and Upgrade Splunk App for Infrastructure guide.

Configure these settings:

Setting Description
Heavy forwarder Enter the hostname or IP address and management port of the heavy forwarder that runs the DCN. By default, the management port is 8089.
Username Enter the name of an admin user for the heavy forwarder that runs the DCN.
Password Enter the password for the admin user.
Worker processes Select how many worker processes you want to run on the DCN. You can run up to 30 worker processes on each DCN, depending on how many CPU cores you allocated to the DCN. Each worker process can manage up to 250 virtual machines and 10 ESXi hosts.

2. Save the configuration

When you're done, click Save to submit the integration.

It can take about 5-10 minutes before the DCN starts scheduling jobs for the DCN.

Bulk upload DCNs

You can upload a CSV file that contains credentials for multiple DCNs to integrate more than one DCN on a DCS at a time. There's no limit to how many vCenter Servers you can upload in a single bulk upload. All passwords are encrypted when you submit the bulk upload.

The CSV file must be a table that looks like this:

URI Username Password Worker Processes
example1.com username1 buttercup123 4
example2.com username2 buttercup456 8

Follow these steps to bulk upload DCNs.

  1. In the SAI user interface, click the Add Data tab.
  2. Select VMware vSphere in the integration panel.
  3. Select the DCN tab and click Add DCN.
  4. Under (Optional) CSV Bulk Upload, click Download the CSV template to view an example of what the CSV file needs to look like.
  5. Upload the CSV file that contains credentials for each vCenter Server you want to integrate.
  6. Review the credentials and click Save to submit the bulk upload.

Test data collection

It can take up to about 10 minutes after you start the DCS to collect data from DCNs. When you should be receiving data from a DCN, run a search to confirm whether you're receiving data.

You can run this search to confirm whether you're receiving metrics in the vmware-perf-metrics index:

|mstats latest(_value) where metric_name=* AND index=vmware-perf-metrics by metric_name

Last modified on 13 July, 2020
PREVIOUS
Collect OpenShift metrics and logs with Splunk App for Infrastructure
  NEXT
Collect VMware vCenter Server and ESXi host log data with Splunk App for Infrastructure

This documentation applies to the following versions of Splunk® App for Infrastructure (Legacy): 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.0, 2.1.1 Cloud only


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters