Splunk® App for VMware (Legacy)

Installation and Configuration Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.

Install the App

Install the App on each Splunk indexer and search head in your environment using the same user account that you used to install Splunk on your systems.

Before you install the App you must have:

  • Splunk indexers or search heads installed on one or more systems in your environment.
  • Sideview utils installed on your search heads.
  • Splunk App for VMware downloaded from Splunkbase to a location in your environment.


To install Splunk App for VMware

  1. Transfer the App package file splunk_app_vmware-1.0.2-138653.zip to a temporary location on each indexer and search head in your environment. Create a temporary directory, for example /tmp on *nix machines or C:\Windows\Temp on Windows machines.
  2. Unzip the App package in the temporary directory. This creates a new "etc" directory.

To install the App on each dedicated indexer in your environment:

  1. If you are running both search heads and indexers on the same Splunk instance, Go to the next section "To install the App on each search head (or combined indexer and search head) in your environment:"
  2. Copy all of the apps in the etc/deployment-apps folder onto each of the indexers. ($SPLUNK_HOME/etc/apps). Use recursive copy to copy all of the files and all of the sub-directories.:
    etc/
    apps/deployment-apps/
    Splunk_TA_vcenter/…
    Splunk_TA_vmware/…
  3. Look in $SPLUNK_HOME/etc/apps and verify that all of the apps were copied correctly.
  4. Go to $SPLUNK_HOME/etc/apps/Splunk_TA_vcenter/default.
  5. Look at your inputs.conf file and check that it is set up as follows:
    [script://.\bin\SetHost.bat]
    disabled = true
  6. Restart Splunk on each indexer. For both Windows and Unix instructions, see "Start and stop Spunk" in the Splunk Admin Manual.
  7. Now that the App is installed you must configure each of your Splunk indexers to listen for data on a (forwarding / receiving) port. See "Set up receiving" in the Splunk product documentation.

To install the App on each search head (or combined indexer and search head) in your environment:

  1. Copy the contents of the apps directory in the temporary etc/apps folder into the apps directory of your Splunk install ($SPLUNK_HOME/etc/apps). Use recursive copy to copy all of the files and all of the sub-directories.
    etc/
    apps/
    DA-VMW-HierarchyInventory/…
    DA-VMW-LogEventTask/…
    DA-VMW-Performance/…
    SA-Utils/…
    SA-VMW-HierarchyInventory/…
    SA-VMW-LogEventTask/…
    SA-VMW-Performance/…
    Splunk_TA_vcenter/…
    Splunk_TA_vmware/…
    splunk_for_vmware/…
  2. Look in $SPLUNK_HOME/etc/apps to verify that all apps were copied correctly.
  3. Restart Splunk. For both Windows and Unix instructions, see "Start and stop Spunk" in the Splunk Admin Manual.
  4. Log into Splunk Web on the search head.
  5. Open a browser and enter the IP address and port number of the OS hosting your search head: http://<ipaddress:8000/>
  6. The Splunk Home page is displayed showing all installed apps. Select Splunk App for VMware from the list. The app is also available from the App menu on the Home screen.
    VMware home.png
  7. If this is a first time install, you are automatically redirected to the Setup page. Complete the details and continue.
  8. If you have not installed Sideview utils you will be informed at this point and you can install it from here. If you need to, click the link and install SideView Utils, then return to the Setup page.
  9. Click save on the Setup page.
  10. Now that the App is installed you must configure each of your Splunk indexers to listen for data on a (forwarding / receiving) port. See "Set up receiving" in the Splunk product documentation.


Spunk is almost ready to receive VMware environment data. You must configure your indexers to handle vCenter Server log files. For more information, see Set the timezone for vCenter log files in this manual.

Last modified on 30 October, 2012
Install Sideview Utils on your search head(s)   About the Add-on

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 1.0, 1.0.1, 1.0.2


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters