The data collection components

The Splunk Forwarder Virtual Appliance for VMware (FA VM) sends data to your Splunk indexers after you configure engine.conf and inputs.conf files. These configuration files enable the FA VM to run engine.pm, the main data collection module inside the FA VM.

Components for collecting data

Component	Description
Forwarder Appliance (FA VM)	This is the FA VM that contains a CentOS 5.7 Linux image, Splunk heavyweight forwarder, and a pre-installed add-on (the Splunk_TA_vmware) that gathers data from VMware by calling the APIs.
engine.pm (the engine)	This is the main data collection module inside the FA VM. Multiple engine.pm processes can run concurrently.engine.pm is a set of scripts that call VMware’s Perl SDK to get data from the VMware environment and send it to Splunk. It controls data collection in your VMware environment. engine.pm reads the data discovery modules in engine.conf that tells the module where to look for the data, the data to collect, and the frequency with which it should gather data. The number of engine.pm instances run is determined by the specifications set in the inputs.conf file.
engine.conf	This Splunk configuration file contains information about the target machines in your vSphere environment that you will manage as part of the Splunk for VMware Solution. It also specifies the data you want to collect from your environment and the frequency with which you want to collect it. The engine.conf file contains stanzas that correspond to the vCenter machines or ESX/i hosts from which you want to collect data. actions that specify the data collection requirements for your target machines are contained within these stanzas are the intervals and other settings that correspond to data collection frequency.This file is read by engine.pm.
action	This is a setting in the engine.conf file that tells engine.pm the data type to collect from your target machines. The data type is associated with an action keyword. For example, to collect hierarchy data use the action “HierarchyDiscovery” in engine.conf. Many actions can be listed for a given target machine in a given stanza.