About the Splunk OVA for VMware Metrics

The Splunk OVA for VMware Metrics is a preconfigured virtual machine with a lightweight operating system, Splunk heavy forwarder and all necessary add-ons and supporting add-ons to collect performance, inventory, tasks and event data from VMWare vCenter servers. The Splunk OVA for VMware Metrics deploys as a Data Collection Node (DCN) to collect data for the Splunk App for Infrastructure (SAI).

VMware vCenter Servers and resources, including data centers, clusters, ESXi hosts, and virtual machines appear as entities in Splunk App for Infrastructure when you start monitoring a vCenter Server with a DCN. You can integrate SAI entities in ITSI to create ITSI services from the SAI entities.

DCNs are required components for any Splunk Add-on for VMware Metrics deployment. If you can't deploy an OVA, you can manually configure a Splunk heavy forwarder to perform as a DCN. For more information, see Configure a heavy forwarder to be a DCN in the Splunk Add-on for VMware Metrics manual.

Requirements and specifications for the Splunk OVA for VMware Metrics

These are the specifications and requirements for the Splunk OVA for VMware Metrics that deploys a Data Collection Node (DCN) to collect VMware vCenter Server data. The OVA contains the following Splunk Enterprise version and operating system. For other compatible versions, see Data Collection Node requirements and limits in the Splunk Supported Add-ons Manual.

• Virtual Hardware v11
• CentOS Linux release 7.9.2009 (Core)
• Disk Size 16 GB
• VMWare Tools 11.0.5.17716 (build-15389592)
• Open ports 22, 8000, 8089, 8065 8008, 1514, and 514
• A Splunk Enterprise version 8.2.4 heavy forwarder
• Splunk Add-on for VMware Metrics v4.2.3 which includes:
  • Splunk_TA_vmware_inframon version 4.2.3
  • SA-Hydra-inframon version 4.2.3
• Splunk Add-on for VMware ESXi logs v4.2.1 which includes Splunk_TA_esxilogs version 4.2.1

You're responsible for the patches introduced in the operating system installed on the OVA. Make sure to regularly update the operating system to avoid vulnerabilities. There is no backward compatibility for the OVA.

Default accounts

The Splunk OVA for VMware Metrics comes with two default user accounts:

Account	Credentials
administrator	splunk/changeme
root user	root/changemenow

Data collection node default configuration

The data collection node deployment has the following default configuration:

• Eight cores. 8 vCPUs or 4 vCPUs with two cores with a reservation of 2GHz.
• 12GB memory with a reservation of 1GB.
• 10-12GB of disk space.

If you have a search head cluster, install the data collection node (DCN) scheduler on a dedicated Splunk instance such as the heavy forwarder.