Splunk® App for Infrastructure

Install and Upgrade Splunk App for Infrastructure

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of InfraApp. Click here for the latest version.
Acrobat logo Download topic as PDF

Upgrade VMware data collection components

To collect VMware data in SAI, you have to install components in the Splunk VMware Add-on for ITSI from the Splunk IT Service Intelligence (ITSI) package. You can't use earlier versions of the Splunk Add-on for VMware.

The Splunk VMware Add-on for ITSI sends metrics to the vmware-perf-metrics metrics index. Previous versions of the Splunk Add-on for VMware send data to the vmware-perf events index. If you want to search historical event data in the vmware-perf events index, include the vmware-perf index in indexes.conf. For more information, see Search historical data after you upgrade.

These steps show you how to upgrade the VMware data collection components from an earlier version of vmware_ta_itsi and the Splunk Add-on for VMware version 3.4.x.

Stop the DCS before upgrading the DCS, DCN, and each indexer. After you upgrade everything, start the DCS.

Upgrade a Data Collection Scheduler

Replace the required components and delete old components that aren't necessary for VMware data collection in SAI on the Data Collection Scheduler (DCS).

Upgrade a DCS running an earlier version of vmware_ta_itsi

Follow these steps to upgrade a DCS that's running an earlier version of vmware_ta_itsi.

  1. If you haven't already, download the ITSI package from Splunkbase.
  2. In the ITSI user interface, click the Add Data tab and select VMware vSphere.
  3. Select the DCN tab and disable Enable Data Collection.
  4. Stop splunkd.
    $SPLUNK_HOME/bin/splunk stop
    
  5. Copy the SA-Hydra and Splunk_TA_vmware directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps.
  6. Start splunkd.
    $SPLUNK_HOME/bin/splunk start
    

Upgrade a DCS running the Splunk Add-on for VMware version 3.4.x

Follow these steps to manually upgrade a DCS that's running the Splunk Add-on for VMware version 3.4.x.

  1. If you haven't already, download the ITSI package from Splunkbase.
  2. Stop the DCS from the Collection Configuration page in the Splunk Add-on for VMware version 3.4.x.
  3. Stop splunkd.
    $SPLUNK_HOME/bin/splunk stop
    
  4. Copy the SA-Hydra and Splunk_TA_vmware directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps.
  5. If any of these directories exist in $SPLUNK_HOME/etc/apps, remove them:
    • SA-VMNetAppUtils
    • SA-VMWIndex
    • TA-VMW-FieldExtractions
    • Splunk_TA_vcenter
    • Splunk_TA_esxilogs
  6. In $SPLUNK_HOME/etc/apps/SA-Hydra, remove the appserver directory.
  7. In $SPLUNK_HOME/etc/apps/SA-Hydra/bin/hydra, remove the uuid.py and uuid.pyc files.
  8. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware, remove the appserver directory.
  9. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/bin, remove the suds directory, and the uuid.py and uuid.pyc files.
  10. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/default, remove the data directory.
  11. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local, remove inputs.conf.
  12. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local, create pool.conf if it doesn't exist already.
    1. Open pool.conf.
    2. Create a [Global pool] stanza.
    3. Move only task-related parameters from the [default] stanza in ta_vmware_collection.conf to the [Global pool] stanza you just created. This include task, atomic_tasks, <task>_expiration, and <task>_interval.
    4. Replace otherperf with clusterperf. For example, rename otherperf_interval to clusterperf_interval.
    5. Remove hierarchyinv and rpinv parameters from the task and atomic_tasks settings if they exist.
    6. Remove interval and expiration parameters for hierarchyinv and rpinv if they exist.
    7. Keep collection parameters other than task-related in ta_vmware_collection.conf.
    8. If your ta_vmware_collection.conf file looks like this:
      [default]
      task = vminv, hostinv, otherperf, rpinv, hierarchyinv
      vminv_interval = 900
      vminv_expiration = 900
      hostinv_interval = 900
      hostinv_expiration = 900
      otherperf_interval = 1800
      otherperf_expiration = 1800
      hierarchyinv_interval = 1800
      hierarchyinv_expiration = 1800
      rpinv_interval = 1800
      rpinv_expiration = 1800
      deployment_type = Custom
      perf_format_type = normal
      host_instance_whitelist = .*ahegd.*
      

      Move these parameters to pool.conf:

      [Global pool]
      task = vminv, hostinv, clusterperf
      vminv_interval = 900
      vminv_expiration = 900 
      hostinv_interval = 900
      hostinv_expiration = 900
      clusterperf_interval = 1800
      clusterperf_expiration = 1800
      

      These are the remaining parameters in ta_vmware_collection.conf:

      [default]
      deployment_type = Custom
      perf_format_type = normal
      host_instance_whitelist = .*ahegd.*
      
  13. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local, make these changes:
    1. Open hyrda_node.conf and add pool_name = Global pool to every stanza.
    2. Open ta_vmware_collection.conf and add pool_name = Global pool to every stanza except the default stanza.
  14. Start splunkd.
    $SPLUNK_HOME/bin/splunk start
    

Upgrade a Data Collection Node

Replace the required components and delete old components that aren't necessary for VMware data collection in SAI on the Data Collection Node (DCN).

Upgrade a DCN running an earlier version of vmware_ta_itsi

Follow these steps to upgrade a DCN that's running an earlier version of vmware_ta_itsi.

  1. If you haven't already, download the ITSI package from Splunkbase.
  2. Stop splunkd.
    $SPLUNK_HOME/bin/splunk stop
    
  3. Copy the SA-Hydra, Splunk_TA_vmware, Splunk_TA_esxilogs, and Splunk_TA_vcenter directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps.
  4. Start splunkd.
    $SPLUNK_HOME/bin/splunk start
    

Upgrade a DCN running the Splunk Add-on for VMware version 3.4.x

Follow these steps to manually upgrade a DCN that's running the Splunk Add-on for VMware version 3.4.x.

  1. If you haven't already, download the ITSI package from Splunkbase.
  2. Stop splunkd.
    $SPLUNK_HOME/bin/splunk stop
    
  3. Copy the SA-Hydra, Splunk_TA_vmware, Splunk_TA_esxilogs, and Splunk_TA_vcenter directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps.
  4. If any of these directories exist in $SPLUNK_HOME/etc/apps, remove them:
    • SA-VMNetAppUtils
    • SA-VMWIndex
    • TA-VMW-FieldExtractions
  5. In $SPLUNK_HOME/etc/apps/SA-Hydra, remove these directories:
    • local
    • appserver
  6. In $SPLUNK_HOME/etc/apps/SA-Hydra/bin/hydra, remove the uuid.py and uuid.pyc files.
  7. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware, remove the appserver directory.
  8. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/bin, remove the suds directory, and the uuid.py and uuid.pyc files.
  9. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local, remove these files:
    • inputs.conf
    • ta_vmware_cache.conf
    • hydra_metadata.conf
    • hydra_session.conf
  10. In $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/default, remove the data directory.
  11. Start splunkd.
    $SPLUNK_HOME/bin/splunk start
    

Upgrade an indexer

Replace the required components and delete old components that aren't necessary for VMware data collection in SAI on each indexer. You can follow these steps if you're running a standalone indexer, a distributed indexer, or a clustered indexer environment.

If you want to continue searching data you already collected from the Splunk Add-on for VMware version 3.4.x, add the old index to the new indexes.conf in SA-VMWIndex during the upgrade process. If you don't include the old index before you start splunkd after upgrading, the indexer deletes the index. For more information, see Search historical data after you upgrade.

For more information about installing the add-on across an indexer cluster, see Update common peer configurations and apps in the Managing Indexers and Clusters of Indexers guide.

Upgrade an indexer running an earlier version of vmware_ta_itsi

Follow these steps to upgrade an indexer that's running an earlier version of vmware_ta_itsi.

  1. If you haven't already, download the ITSI package from Splunkbase.
  2. Stop splunkd:
    $SPLUNK_HOME/bin/splunk stop
    
  3. Copy the SA-VMWIndex, Splunk_TA_esxilogs, and Splunk_TA_vcenter directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps. If you want to continue monitoring historical data, add the old index to the new indexes.conf in SA-VMWIndex. If you don't include the old index, the indexer deletes the index. See Search historical data after you upgrade.
  4. Start splunkd:
    $SPLUNK_HOME/bin/splunk start
    

Upgrade an indexer running the Splunk Add-on for VMware version 3.4.x

Following these steps to update an indexer that's running the Splunk Add-on for VMware version 3.4.x.

  1. If you haven't already, download the ITSI package from Splunkbase.
  2. Stop splunkd:
    $SPLUNK_HOME/bin/splunk stop
    
  3. Copy the SA-VMWIndex, Splunk_TA_esxilogs, and Splunk_TA_vcenter directories from the vmware_ta_itsi parent directory in the ITSI package to $SPLUNK_HOME/etc/apps. If you want to continue monitoring historical data, add the old index to the new indexes.conf in SA-VMWIndex. If you don't include the old index, the indexer deletes the index. See Search historical data after you upgrade.
  4. If any of these directories exist in $SPLUNK_HOME/etc/apps, remove them.
    • SA-VMNetAppUtils
    • SA-VMWIndex
    • TA-VMW-FieldExtractions
  5. Start splunkd:
    $SPLUNK_HOME/bin/splunk start
    

Search historical data after you upgrade

You can continue searching historical data that the Splunk Add-on for VMware version 3.4.5 indexed. To do so, you have to add the vmware-perf stanza to $SPLUNK_HOME/etc/apps/SA-VMWIndex/local.

Follow these steps to search historical data after you upgrade to the Splunk VMware Add-on for ITSI.

  1. Stop splunkd:
    $SPLUNK_HOME/bin/splunk stop
    
  2. In $SPLUNK_HOME/etc/apps/SA-VMWIndex/local, create indexes.conf if it doesn't already exist.
  3. Open indexes.conf and add this stanza:
    [vmware-perf]
    homePath = $SPLUNK_DB/vmware-perf/db
    coldPath = $SPLUNK_DB/vmware-perf/colddb
    thawedPath = $SPLUNK_DB/vmware-perf/thaweddb
    repFactor = auto
    
  4. Start splunkd:
    $SPLUNK_HOME/bin/splunk start
    
Last modified on 12 June, 2020
PREVIOUS
Deploy a Data Collection Scheduler
  NEXT
Update a Data Collection Node after migrating Python versions

This documentation applies to the following versions of Splunk® App for Infrastructure: 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.0, 2.1.1 Cloud only


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters