Upgrade VMware data collection components

To collect VMware data in SAI, you have to install components in the Splunk VMware Add-on for ITSI from the Splunk IT Service Intelligence (ITSI) package. You can't use earlier versions of the Splunk Add-on for VMware.

The Splunk VMware Add-on for ITSI sends metrics to the vmware-perf-metrics metrics index. Previous versions of the Splunk Add-on for VMware send data to the vmware-perf events index. If you want to search historical event data in the vmware-perf events index, include the vmware-perf index in indexes.conf. For more information, see Search historical data after you upgrade.

These steps show you how to upgrade the VMware data collection components from an earlier version of vmware_ta_itsi and the Splunk Add-on for VMware version 3.4.x.

Stop the DCS before upgrading the DCS, DCN, and each indexer. After you upgrade everything, start the DCS.

Upgrade a Data Collection Scheduler

Replace the required components and delete old components that aren't necessary for VMware data collection in SAI on the Data Collection Scheduler (DCS).

Upgrade a DCS running an earlier version of vmware_ta_itsi

Follow these steps to upgrade a DCS that's running an earlier version of vmware_ta_itsi.

1. If you haven't already, download the ITSI package from Splunkbase.
2. In the ITSI user interface, click the Add Data tab and select VMware vSphere.
3. Select the DCN tab and disable Enable Data Collection.
4. Stop splunkd.

   $SPLUNK_HOME/bin/splunk stop
   

5. Copy the SA-Hydra and Splunk_TA_vmware directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps.
6. Start splunkd.

   $SPLUNK_HOME/bin/splunk start
   

Upgrade a DCS running the Splunk Add-on for VMware version 3.4.x

Follow these steps to manually upgrade a DCS that's running the Splunk Add-on for VMware version 3.4.x.

1. If you haven't already, download the ITSI package from Splunkbase.
2. Stop the DCS from the Collection Configuration page in the Splunk Add-on for VMware version 3.4.x.
3. Stop splunkd.

   $SPLUNK_HOME/bin/splunk stop
   

4. Copy the SA-Hydra and Splunk_TA_vmware directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps.
5. If any of these directories exist in $SPLUNK_HOME/etc/apps, remove them:
   • SA-VMNetAppUtils
   • SA-VMWIndex
   • TA-VMW-FieldExtractions
   • Splunk_TA_vcenter
   • Splunk_TA_esxilogs
6. In $SPLUNK_HOME/etc/apps/SA-Hydra, remove the appserver directory.
7. In $SPLUNK_HOME/etc/apps/SA-Hydra/bin/hydra, remove the uuid.py and uuid.pyc files.
8. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware, remove the appserver directory.
9. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/bin, remove the suds directory, and the uuid.py and uuid.pyc files.
10. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/default, remove the data directory.
11. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local, remove inputs.conf.
12. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local, create pool.conf if it doesn't exist already.
1. Open pool.conf.
2. Create a [Global pool] stanza.
3. Move only task-related parameters from the [default] stanza in ta_vmware_collection.conf to the [Global pool] stanza you just created. This include task, atomic_tasks, <task>_expiration, and <task>_interval.
4. Replace otherperf with clusterperf. For example, rename otherperf_interval to clusterperf_interval.
5. Remove hierarchyinv and rpinv parameters from the task and atomic_tasks settings if they exist.
6. Remove interval and expiration parameters for hierarchyinv and rpinv if they exist.
7. Keep collection parameters other than task-related in ta_vmware_collection.conf.
8. If your ta_vmware_collection.conf file looks like this:

   [default]
   task = vminv, hostinv, otherperf, rpinv, hierarchyinv
   vminv_interval = 900
   vminv_expiration = 900
   hostinv_interval = 900
   hostinv_expiration = 900
   otherperf_interval = 1800
   otherperf_expiration = 1800
   hierarchyinv_interval = 1800
   hierarchyinv_expiration = 1800
   rpinv_interval = 1800
   rpinv_expiration = 1800
   deployment_type = Custom
   perf_format_type = normal
   host_instance_whitelist = .*ahegd.*
   

   Move these parameters to pool.conf:

   [Global pool]
   task = vminv, hostinv, clusterperf
   vminv_interval = 900
   vminv_expiration = 900 
   hostinv_interval = 900
   hostinv_expiration = 900
   clusterperf_interval = 1800
   clusterperf_expiration = 1800
   

   These are the remaining parameters in ta_vmware_collection.conf:

   [default]
   deployment_type = Custom
   perf_format_type = normal
   host_instance_whitelist = .*ahegd.*
   

13. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local, make these changes:
1. Open hyrda_node.conf and add pool_name = Global pool to every stanza.
2. Open ta_vmware_collection.conf and add pool_name = Global pool to every stanza except the default stanza.
14. Start splunkd.

    $SPLUNK_HOME/bin/splunk start
    

Upgrade a Data Collection Node

Replace the required components and delete old components that aren't necessary for VMware data collection in SAI on the Data Collection Node (DCN).

Upgrade a DCN running an earlier version of vmware_ta_itsi

Follow these steps to upgrade a DCN that's running an earlier version of vmware_ta_itsi.

1. If you haven't already, download the ITSI package from Splunkbase.
2. Stop splunkd.

   $SPLUNK_HOME/bin/splunk stop
   

3. Copy the SA-Hydra, Splunk_TA_vmware, Splunk_TA_esxilogs, and Splunk_TA_vcenter directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps.
4. Start splunkd.

   $SPLUNK_HOME/bin/splunk start
   

Upgrade a DCN running the Splunk Add-on for VMware version 3.4.x

Follow these steps to manually upgrade a DCN that's running the Splunk Add-on for VMware version 3.4.x.

1. If you haven't already, download the ITSI package from Splunkbase.
2. Stop splunkd.

   $SPLUNK_HOME/bin/splunk stop
   

3. Copy the SA-Hydra, Splunk_TA_vmware, Splunk_TA_esxilogs, and Splunk_TA_vcenter directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps.
4. If any of these directories exist in $SPLUNK_HOME/etc/apps, remove them:
   • SA-VMNetAppUtils
   • SA-VMWIndex
   • TA-VMW-FieldExtractions
5. In $SPLUNK_HOME/etc/apps/SA-Hydra, remove these directories:
   • local
   • appserver
6. In $SPLUNK_HOME/etc/apps/SA-Hydra/bin/hydra, remove the uuid.py and uuid.pyc files.
7. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware, remove the appserver directory.
8. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/bin, remove the suds directory, and the uuid.py and uuid.pyc files.
9. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local, remove these files:
   • inputs.conf
   • ta_vmware_cache.conf
   • hydra_metadata.conf
   • hydra_session.conf
10. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/default, remove the data directory.
11. Start splunkd.

    $SPLUNK_HOME/bin/splunk start
    

Upgrade an indexer

Replace the required components and delete old components that aren't necessary for VMware data collection in SAI on each indexer. You can follow these steps if you're running a standalone indexer, a distributed indexer, or a clustered indexer environment.

If you want to continue searching data you already collected from the Splunk Add-on for VMware version 3.4.x, add the old index to the new indexes.conf in SA-VMWIndex during the upgrade process. If you don't include the old index before you start splunkd after upgrading, the indexer deletes the index. For more information, see Search historical data after you upgrade.

For more information about installing the add-on across an indexer cluster, see Update common peer configurations and apps in the Managing Indexers and Clusters of Indexers guide.

Upgrade an indexer running an earlier version of vmware_ta_itsi

Follow these steps to upgrade an indexer that's running an earlier version of vmware_ta_itsi.

1. If you haven't already, download the ITSI package from Splunkbase.
2. Stop splunkd:

   $SPLUNK_HOME/bin/splunk stop
   

3. Copy the SA-VMWIndex, Splunk_TA_esxilogs, and Splunk_TA_vcenter directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps. If you want to continue monitoring historical data, add the old index to the new indexes.conf in SA-VMWIndex. If you don't include the old index, the indexer deletes the index. See Search historical data after you upgrade.
4. Start splunkd:

   $SPLUNK_HOME/bin/splunk start
   

Upgrade an indexer running the Splunk Add-on for VMware version 3.4.x

Following these steps to update an indexer that's running the Splunk Add-on for VMware version 3.4.x.

1. If you haven't already, download the ITSI package from Splunkbase.
2. Stop splunkd:

   $SPLUNK_HOME/bin/splunk stop
   

3. Copy the SA-VMWIndex, Splunk_TA_esxilogs, and Splunk_TA_vcenter directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps. If you want to continue monitoring historical data, add the old index to the new indexes.conf in SA-VMWIndex. If you don't include the old index, the indexer deletes the index. See Search historical data after you upgrade.
4. If any of these directories exist in $SPLUNK_HOME/etc/apps, remove them.
   • SA-VMNetAppUtils
   • SA-VMWIndex
   • TA-VMW-FieldExtractions
5. Start splunkd:

   $SPLUNK_HOME/bin/splunk start
   

Search historical data after you upgrade

You can continue searching historical data that the Splunk Add-on for VMware version 3.4.5 indexed. To do so, you have to add the vmware-perf stanza to $SPLUNK_HOME/etc/apps/SA-VMWIndex/local.

Follow these steps to search historical data after you upgrade to the Splunk VMware Add-on for ITSI.

1. Stop splunkd:

   $SPLUNK_HOME/bin/splunk stop
   

2. In $SPLUNK_HOME/etc/apps/SA-VMWIndex/local, create indexes.conf if it doesn't already exist.
3. Open indexes.conf and add this stanza:

   [vmware-perf]
   homePath = $SPLUNK_DB/vmware-perf/db
   coldPath = $SPLUNK_DB/vmware-perf/colddb
   thawedPath = $SPLUNK_DB/vmware-perf/thaweddb
   repFactor = auto
   

4. Start splunkd:

   $SPLUNK_HOME/bin/splunk start