Configure the Splunk OVA for VMWare

Configure the DCN system settings

Use the dcn-network-config script to perform network configurations for your DCN. The dcn-network-config script lets users set up IP addresses, gateways, netmasks, DNS/nameservers, and hostnames. The dcn-network-config script can also perform network connectivity tests. Note: Press the Enter button on any prompt to keep current values for any configuration prompt.

1. Use SSH to log in to your DCN using root/changemenow. Your Splunk platform will start.
2. (Optional) Use the the help command with the dcn-network-config to get more information on how to run the script in non-interactive mode. dcn-network-config –help
3. Enter the IPv4 address that you want to set or change for your deployment. Enter the IPv4 address [Example: 66.248.79.118]:
4. Enter the gateway to set or change any gateway server. Enter the IPv4 address of the default gateway [Example: 10.0.1.1]:
5. Enter the netmask to set or change any netmask. Enter the Netmask [Example: 255.255.240.0]:
6. Enter the DNS/Nameserver to set or change any DNS/Nameserver. Add multiple DNS/Nameservers by separating them with commas Enter DNS/Nameserver [Example: 10.0.1.9,8.8.8.8,8.8.4.4]
7. Enter the Hostname to set or change any hostname. If you change the hostname, then a restart of your Splunk platform is required. Note: Splunk recommends that you change the default hostname localhost.localdomain. Enter Hostname (Requires Splunk restart) Example: [localhost.localdomain] :
8. Review the configurations. If you have not made any changes, the script will perform network tests and exit.

   Configurations:-
   IPv4 address: 66.248.79.118
   IPv4 address of the default gateway: 10.0.1.1
   Netmask: 255.255.255.0
   DNS/Nameserver: 8.8.8.8
   Hostname: localhost.localdomain
   

9. Enter y to save your changes. Do you want to save network configurations(y/n)?
10. Enter y to restart your network service. Do you want to restart the Splunk Server for your changes to take effect(y/n)?
11. Log out of your DCN.

Note: Run the script in non-interactive mode by providing all the configuration options in one line. Example: dcn-network-config --ipaddr=10.0.3.37 --mask=255.255.240.0 --gw=10.0.1.1 --dns=10.0.1.9,8.8.8.8,8.8.4.4 --hostname=localhost.localdomain --networkrestart=y --save=y

Configure the DCN for your Splunk platform environment

Configure the Splunk platform connection settings for each DCN that you deploy in your environment.

1. Use SSH to log in to your DCN using splunk/changeme.
2. Type dcn-splunk-config into the CLI, and press enter. Splunk will start.
3. Change the default changeme password. Reenter your changed password and press enter.

   Enter new password [*****]:
   Re-enter new password:

4. Enter the host address and port of each indexer, separated by comma, where you want to forward the data your DCN collects. <host>:<port>[]:
5. Add the license master host address. If you haven't changed the default management port and will add https:// and port 8089 by default, you only need to add hostname of the license master. If you have changed the management port then you need to add a hostname as well as management port. Enter license master(https://<host>:<port>)[self]:
6. Review your configurations.

   Configurations:-
   Indexer configuration: 
   License master: self 
   

7. Enter y to save your changes. Do you want to save Splunk configurations(y/n)?
8. Enter y to restart your Splunk platform instance. Do you want to restart the Splunk Server for your changes to take effect(y/n)?
9. Log out of the DCN.

Configure the Splunk OVA to a partition (Optional)

if your Splunk OVA needs more than 6GB of storage space, you need to create a new partition on the OVA machine, and have SPLUNK_DB point to that partition.

1. Create a new partition on the OVA machine Go to Managing Disk Storage to learn how to create a new partition.
2. Point SPLUNK_DB to your new partition

Once your new partition has been created, point SPLUNK_DB to the newly-created partition. To learn how to point SPLUNK_DB to your new partition, read "Move the index database".

Configure DCNs to scale vertically (Optional)

You can configure more than 8 worker processes per DCN by scaling your Splunk Enterprise environment vertically. This lets you increase the number of available worker processes from 8, up to 30.

Note: It is possible to configure more worker processes per DCN, but adding more DCNs as scaling workers to enable horizontal scaling is the recommended deployment practice.

Use the Collection Configuration page to register a DCN with the scheduler

The Collection Configuration page, on your Splunk platform scheduler, manages the Data Collection Nodes (DCNs). Register and configure each DCN separately with the Collection Configuration page in order to collect data from vCenter Server.

1. Log in to Splunk Web on your scheduler as admin.
2. From the App menu, select Splunk Add-on for VMware.
3. Navigate to Collection Configuration, then click +.
4. Enter the settings for the data collection node, then Click Save. Data Collection Node configuration settings

   Field	Value
   Splunk Forwarder URI	The address or port of the DCN. For example, https://<host_name_or_ip_address_of_DCN>:8089.
   Splunk Forwarder Username	admin.
   Splunk Forwarder Password	The administrator password. Make sure this password is not the Splunk Enterprise default admin password (changeme).
   Worker Processes	The number of worker processes must be one fewer than the number of CPU cores the vCenter Server system granted to the DCN. For example, if the DCN has four CPU cores, the number of worker processes is three.

5. Confirm that you correctly configured the DCN by verifying that the DCN, credential validation, and add-on validation all display a green check.
6. Repeat the steps for each DCN.