Deploy a Data Collection Scheduler

Deploy a Data Collection Scheduler (DCS) to integrate VMware vSphere vCenter Servers and manage each Data Collection Node (DCN) you deploy. A DCS schedules jobs and manages DCNs that collect data from vCenter Servers. There are a few places to deploy the DCS:

• You can modify a Data Collection Node (DCN) to also act as a DCS.
• If you're running a single-instance search head environment, you can deploy the DCS on the search head.
• If you're running a distributed search head environment, you can deploy the DCS on a dedicated Splunk Enterprise instance or modify a DCN to also act as a DCS.

When you integrate a VMware vCenter Server on a DCS, you have to provide credentials for a user account associated with the vCenter Server on the DCS. For information about user account requirements, including the permissions the user account needs to have, see User account permissions.

Prerequisites

• You viewed the DCS requirements. See Data Collection Scheduler requirements.
• You have an available Splunk Enterprise instance running CentOS 6 or 7. For more information, see Install on Linux in the Splunk Enterprise Installation Manual.

Steps

Follow these steps to deploy a DCS.

1. Install the app and add-ons

Download the Splunk App for Infrastructure (SAI) version 2.0.0 on Splunkbase.

Download the Splunk IT Service Intelligence (ITSI) version 4.4 package on Splunkbase and extract these add-ons:

Add-on	Description
Splunk_TA_vmware	Runs a Python-based API data collection engine and performs search-time tagging of VMware data.
SA-Hydra	Runs worker processes to collect VMware data from vCenter Servers.

To install SAI, put the splunk-app-for-infrastructure_200 directory in the $SPLUNK_HOME/etc/apps directory on the Splunk Enterprise instance

To install the add-ons from the ITSI package , copy Splunk_TA_vmware and SA-Hydra from the ITSI version 4.4 package to the $SPLUNK_HOME/etc/apps directory on the Splunk Enterprise instance.

2. Configure your ITSI license

To use the out of the box visualizations in SAI for VMware data you need an ITSI license. Add your ITSI license to the Splunk Enterprise instance. You have two options to add your license to the instance:

• Install the license manually. For more information, see Install a license in the Splunk Enterprise Admin Manual.
• Configure the instance as a license peer. For more information, see Configure a license peer in the Splunk Enterprise Admin Manual.

3. Start integrating VMware vCenter Servers and manage DCNs

Integrate Data Collection Nodes (DCNs) and vCenter Servers on a DCS. If you have multiple DCSs, you have to integrate a DCN and vCenter with the same DCS. For example, if you deployed 3 DCSs to manage VMware data collection, and you configured DCN A to collect data from vCenter B, use DCS 1 to manage DCN A and integrate vCenter B.

If you haven't deployed a DCN yet, do that now. For more information, see Deploy a Data Collection Node.

To integrate a vCenter, see Collect VMware vCenter Server metrics with Splunk App for Infrastructure.

Change default collection intervals

After you deploy the DCN, you can modify default collection intervals. Change collection intervals to reduce the load on your Data Collection Nodes (DCNs) and your vCenter Servers. First change the time interval for host inventory jobs, then change the time interval for host performance data. The unit of time for collection intervals is seconds.

1. On the instance that runs the DCS, go to $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local.
2. Open the pool.conf file. If the file doesn't exist yet, create it now.
3. In the [Global pool] stanza, change the hostinv_interval and hostinv_expiration values. If the [Global pool] stanza doesn't exist, create it.
4. Changes values for hostinv_interval and hostinv_expiration. These setting have to have the same values. The maximum value is 2700.
5. Change values for hostvmperf_interval and hostvmperf_expiration. These settings have to have the same values. The maximum value is 1200.
6. Save your changes and exit.