Splunk® App for VMware (Legacy)

Installation and Configuration Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.

About installation tools

The Splunk Forwarder Virtual Appliance for VMware (FA VM) collects data from your VMware environment, forwards the data to Splunk indexers where the data is searched and mapped to the Splunk App for VMware.

You must install and configure the FA VM to work in your environment for the data to be Splunked successfully and displayed in the App. You must also have service accounts created on the machines you are splunking to enable the collection of data.

We have simplified the FA VM installation and configuration process by providing a set of installation tools that automatically configure your environment for you. These tools are:

  • logincreator.pl: This tool creates service accounts on your ESX/i hosts. You can also run it to check service account credentials. It can find valid service accounts on vCenter and all of its managed hosts or on a single host.
  • enginebuilder.py: This is a tool that you run to automatically create the engine.conf configuration files. The engine.conf file is read by the engine and specifies the data to be collected in your environment. It provides information about three key areas; the target machine(s) to query, the type(s) of data to query, and the frequency at which to execute data collection actions. This tool takes a template file, engine.template, as input. Edit this template file to specify key information about your environment. Note: We recommend that you use enginebuilder.py especially when evaluating the Solution or when configuring the Solution for a large environment.
  • credentials.pl: This is a tool you can use as the Splunkadmin user to obfuscate passwords in your engine.conf files. Before running the tool you need a working engine.conf file with the usernames and the passwords already in it. The usernames and passwords are the credentials for the service accounts you created for the vCenter and ESX/i hosts and they are used during installation to create the engine.conf and credentials.conf files.
Last modified on 31 December, 2012
The data collection components   Logincreator.pl

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 1.0.2, 1.0.3, 2.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters