Splunk® App for Infrastructure (Legacy)

Install and Upgrade Splunk App for Infrastructure

This documentation does not apply to the most recent version of Splunk® App for Infrastructure (Legacy). For documentation on the most recent version, go to the latest release.

Upgrade VMware data collection components

To collect VMware data in SAI, you have to install components in the Splunk VMware Add-on for ITSI from the Splunk IT Service Intelligence (ITSI) package. You can't use earlier versions of the Splunk Add-on for VMware.

The Splunk VMware Add-on for ITSI sends metrics to the vmware-perf-metrics metrics index. Previous versions of the Splunk Add-on for VMware send data to the vmware-perf events index. If you want to search historical event data in the vmware-perf events index, include the vmware-perf index in indexes.conf. For more information, see Search historical data after you upgrade.

These steps show you how to upgrade the VMware data collection components from the Splunk Add-on for VMware version 3.4.x.

Stop the DCS from the Collection Configuration page in the Splunk Add-on for VMware version 3.4.x before upgrading the DCS, DCN, and each indexer. After you upgrade everything, start the DCS. To start a DCS, complete these steps:

  1. From Splunk Web, go to Add Data and select VMware vSphere from the integrations panel.
  2. Select the DCN tab.
  3. Toggle Enable Data Collection to enable the DCS.

Upgrade a Data Collection Scheduler

Replace the required components and delete old components that aren't necessary for VMware data collection in SAI on the Data Collection Scheduler (DCS).

Manually upgrade a DCS

Follow these steps to manually upgrade a DCS.

  1. If you haven't already, download the ITSI version 4.4.0 package from Splunkbase.
  2. Stop the DCS from the Collection Configuration page in the Splunk Add-on for VMware version 3.4.x.
  3. Stop splunkd. 
    $SPLUNK_HOME/bin/splunk stop
  4. Copy the SA-Hydra and Splunk_TA_vmware directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps.
  5. If any of these directories exist in $SPLUNK_HOME/etc/apps, remove them:
    • SA-VMNetAppUtils
    • SA-VMWIndex
    • TA-VMW-FieldExtractions
    • Splunk_TA_vcenter
    • Splunk_TA_esxilogs
  6. In $SPLUNK_HOME/etc/apps/SA-Hydra, remove the appserver directory.
  7. In $SPLUNK_HOME/etc/apps/SA-Hydra/bin/hydra, remove the uuid.py and uuid.pyc files.
  8. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware, remove the appserver directory.
  9. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/bin, remove the suds directory, and the uuid.py and uuid.pyc files.
  10. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/default, remove the data directory.
  11. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local, remove inputs.conf.
  12. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local, create pool.conf if it doesn't exist already.
    1. Open pool.conf.
    2. Create a [Global pool] stanza.
    3. Move only task-related parameters from the [default] stanza in ta_vmware_collection.conf to the [Global pool] stanza you just created. This include task, atomic_tasks, <task>_expiration, and <task>_interval.
    4. Replace otherperf with clusterperf. For example, rename otherperf_interval to clusterperf_interval.
    5. Remove hierarchyinv and rpinv parameters from the task and atomic_tasks settings if they exist.
    6. Remove interval and expiration parameters for hierarchyinv and rpinv if they exist.
    7. Keep collection parameters other than task-related in ta_vmware_collection.conf.
    8. If your ta_vmware_collection.conf file looks like this: 
      [default]
task = vminv, hostinv, otherperf, rpinv, hierarchyinv
vminv_interval = 900
vminv_expiration = 900
hostinv_interval = 900
hostinv_expiration = 900
otherperf_interval = 1800
otherperf_expiration = 1800
hierarchyinv_interval = 1800
hierarchyinv_expiration = 1800
rpinv_interval = 1800
rpinv_expiration = 1800
deployment_type = Custom
perf_format_type = normal
host_instance_whitelist = .*ahegd.*

      Move these parameters to pool.conf: 

      [Global pool]
task = vminv, hostinv, clusterperf
vminv_interval = 900
vminv_expiration = 900 
hostinv_interval = 900
hostinv_expiration = 900
clusterperf_interval = 1800
clusterperf_expiration = 1800

      These are the remaining parameters in ta_vmware_collection.conf: 

      [default]
deployment_type = Custom
perf_format_type = normal
host_instance_whitelist = .*ahegd.*
  13. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local, make these changes:
    1. Open hyrda_node.conf and add pool_name = Global pool to every stanza.
    2. Open ta_vmware_collection.conf and add pool_name = Global pool to every stanza except the default stanza.
  14. Start splunkd. 
    $SPLUNK_HOME/bin/splunk start


Upgrade a Data Collection Node

Replace the required components and delete old components that aren't necessary for VMware data collection in SAI on the Data Collection Node (DCN).

Manually upgrade a DCN

Follow these steps to manually upgrade a DCN.

  1. If you haven't already, download the ITSI version 4.4.0 package from Splunkbase.
  2. Stop splunkd. 
    $SPLUNK_HOME/bin/splunk stop
  3. Copy the SA-Hydra and Splunk_TA_vmware directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps. If you're forwarding vCenter Server log or ESXi host log data to the DCN, also copy Splunk_TA_vcenter and Splunk_TA_esxilogs to the directory.
  4. If any of these directories exist in $SPLUNK_HOME/etc/apps, remove them:
    • SA-VMNetAppUtils
    • SA-VMWIndex
    • TA-VMW-FieldExtractions
  5. In $SPLUNK_HOME/etc/apps/SA-Hydra, remove these directories:
    • local
    • appserver
  6. In $SPLUNK_HOME/etc/apps/SA-Hydra/bin/hydra, remove the uuid.py and uuid.pyc files.
  7. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware, remove the appserver directory.
  8. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/bin, remove the suds directory, and the uuid.py and uuid.pyc files.
  9. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local, remove these files:
    • inputs.conf
    • ta_vmware_cache.conf
    • hydra_metadata.conf
    • hydra_session.conf
  10. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/default, remove the data directory.
  11. Start splunkd. 
    $SPLUNK_HOME/bin/splunk start


Upgrade an indexer

Replace the required components and delete old components that aren't necessary for VMware data collection in SAI on each indexer. You can follow these steps if you're running a standalone indexer, a distributed indexer, or a clustered indexer environment.

If you want to continue searching data you already collected from the Splunk Add-on for VMware version 3.4.x, add the old index to the new indexes.conf in SA-VMWIndex during the upgrade process. If you don't include the old index before you start splunkd after upgrading, the indexer deletes the index. For more information, see Search historical data after you upgrade.

For more information about installing the add-on across an indexer cluster, see Update common peer configurations and apps in the Managing Indexers and Clusters of Indexers guide.

  1. If you haven't already, download the ITSI version 4.4.0 package from Splunkbase.
  2. If you're running a single-instance or distributed indexer environment, stop splunkd: 
    $SPLUNK_HOME/bin/splunk stop
    If you're running a distributed indexer environment and have downtime concerns, you can keep at least one indexer running at a time. For more information, see Upgrade the indexers in the Splunk Enterprise Installation Manual. If you're running a clustered indexer environment, don't stop splunkd, and instead enable maintenance-mode on the indexer cluster master node. For more information, see Enable maintenance mode.
  3. Copy the SA-VMWIndex, Splunk_TA_esxilogs, and Splunk_TA_vcenter directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps. If you're running a clustered indexer environment, copy the directories to the $SPLUNK_HOME/etc/master-apps directory instead. If you want to continue monitoring historical data, add the old index to the new indexes.conf in SA-VMWIndex. If you don't include the old index, the indexer deletes the index. See Search historical data after you upgrade..
  4. If any of these directories exist in $SPLUNK_HOME/etc/apps, remove them. If you're running a clustered indexer environment, check $SPLUNK_HOME/etc/master-apps instead.
    • SA-VMNetAppUtils
    • SA-VMWIndex
    • TA-VMW-FieldExtractions
  5. If you're running a clustered indexer environment, distribute the configuration bundle to the peers in the cluster. For more information, see Distribute the configuration bundle in the Managing Indexers and Clusters of Indexers guide.
  6. If you're running a single-instance or distributed indexer environment, start splunkd: 
    $SPLUNK_HOME/bin/splunk start
    If you're running a clustered indexer environment, disable maintenance-mode on the indexer cluster master node.

Search historical data after you upgrade

You can continue searching historical data that the Splunk Add-on for VMware version 3.4.5 indexed. To do so, you have to add the vmware-perf stanza to $SPLUNK_HOME/etc/apps/SA-VMWIndex/local.

Follow these steps to search historical data after you upgrade to the Splunk VMware Add-on for ITSI.

  1. If you're running a single-instance or distributed indexer environment, stop splunkd: 
    $SPLUNK_HOME/bin/splunk stop
    If you're running a distributed indexer environment and have downtime concerns, you can keep at least one indexer running at a time. For more information, see Upgrade the indexers in the Splunk Enterprise Installation Manual. If you're running a clustered indexer environment, don't stop splunkd, and instead enable maintenance-mode on the indexer cluster master node. For more information, see Enable maintenance mode.
  2. In $SPLUNK_HOME/etc/apps/SA-VMWIndex/local, create indexes.conf if it doesn't already exist.
  3. Open indexes.conf and add this stanza: 
    [vmware-perf]
homePath = $SPLUNK_DB/vmware-perf/db
coldPath = $SPLUNK_DB/vmware-perf/colddb
thawedPath = $SPLUNK_DB/vmware-perf/thaweddb
repFactor = auto
  4. If you're running a clustered indexer environment, distribute the configuration bundle to the peers in the cluster. For more information, see Distribute the configuration bundle in the Managing Indexers and Clusters of Indexers guide.
  5. If you're running a single-instance or distributed indexer environment, start splunkd: 
    $SPLUNK_HOME/bin/splunk start
    If you're running a clustered indexer environment, disable maintenance-mode on the indexer cluster master node.
Last modified on 03 February, 2020
Deploy a Data Collection Scheduler   Update a Data Collection Node after migrating Python versions

This documentation applies to the following versions of Splunk® App for Infrastructure (Legacy): 2.0.0

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters