Splunk® App for Infrastructure

Install and Upgrade Splunk App for Infrastructure

Download manual as PDF

Download topic as PDF

Deploy a Data Collection Scheduler

Deploy a Data Collection Scheduler (DCS) to integrate VMware vSphere vCenter Servers and manage each Data Collection Node (DCN) you deploy. A DCS schedules jobs and manages DCNs that collect data from vCenter Servers. There are a few places to deploy the DCS:

  • You can modify a Data Collection Node (DCN) to also act as a DCS.
  • If you're running a single-instance search head environment, you can deploy the DCS on the search head.
  • If you're running a distributed search head environment, you can deploy the DCS on a dedicated Splunk Enterprise instance or modify a DCN to also act as a DCS.

When you integrate a VMware vCenter Server on a DCS, you have to provide credentials for a user account associated with the vCenter Server on the DCS. For information about user account requirements, including the permissions the user account needs to have, see User account permissions.

Prerequisites

Steps

Follow these steps to deploy a DCS.

1. Install the app and add-ons

Download the Splunk App for Infrastructure (SAI) version 2.0.0 on Splunkbase.

Download the Splunk IT Service Intelligence (ITSI) version 4.4 package on Splunkbase and extract these add-ons:

Add-on Description
Splunk_TA_vmware Runs a Python-based API data collection engine and performs search-time tagging of VMware data.
SA-Hydra Runs worker processes to collect VMware data from vCenter Servers.

To install SAI, put the splunk-app-for-infrastructure_200 directory in the $SPLUNK_HOME/etc/apps directory on the Splunk Enterprise instance

To install the add-ons from the ITSI package , copy Splunk_TA_vmware and SA-Hydra from the ITSI version 4.4 package to the $SPLUNK_HOME/etc/apps directory on the Splunk Enterprise instance.

2. Configure your ITSI license

Add your ITSI license to the Splunk Enterprise instance. You have two options to add your license to the instance:

  • Install the license manually. For more information, see Install a license in the Splunk Enterprise Admin Manual.
  • Configure the instance as a license slave. For more information, see Configure a license slave in the Splunk Enterprise Admin Manual.

3. Start integrating VMware vCenter Servers and manage DCNs

Integrate Data Collection Nodes (DCNs) and vCenter Servers on a DCS. If you have multiple DCSs, you have to integrate a DCN and vCenter with the same DCS. For example, if you deployed 3 DCSs to manage VMware data collection, and you configured DCN A to collect data from vCenter B, use DCS 1 to manage DCN A and integrate vCenter B.

If you haven't deployed a DCN yet, do that now. For more information, see Deploy a Data Collection Node.

To integrate a vCenter, see Collect VMware vCenter Server metrics with Splunk App for Infrastructure.

Change default collection intervals

After you deploy the DCN, you can modify default collection intervals. Change collection intervals to reduce the load on your Data Collection Nodes (DCNs) and your vCenter Servers. First change the time interval for host inventory jobs, then change the time interval for host performance data. The unit of time for collection intervals is seconds.

  1. On the instance that runs the DCS, go to $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local.
  2. Open the pool.conf file. If the file doesn't exist yet, create it now.
  3. In the [Global pool] stanza, change the hostinv_interval and hostinv_expiration values. If the [Global pool] stanza doesn't exist, create it.
  4. Changes values for hostinv_interval and hostinv_expiration. These setting have to have the same values. The maximum value is 2700.
  5. Change values for hostvmperf_interval and hostvmperf_expiration. These settings have to have the same values. The maximum value is 1200.
  6. Save your changes and exit.
Last modified on 18 March, 2020
PREVIOUS
Deploy a Data Collection Node
  NEXT
Upgrade VMware data collection components

This documentation applies to the following versions of Splunk® App for Infrastructure: 2.0.0, 2.0.1, 2.0.2, 2.0.3


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters