About installation tools

The Splunk Forwarder Virtual Appliance for VMware (FA VM) collects data from your VMware environment, forwards the data to Splunk indexers where the data is searched and mapped to the Splunk App for VMware.

You must install and configure the FA VM to work in your environment for the data to be Splunked successfully and displayed in the App. You must also have service accounts created on the machines you are splunking to enable the collection of data.

We have simplified the FA VM installation and configuration process by providing a set of installation tools that automatically configure your environment for you. These tools are:

• logincreator.pl: This tool creates service accounts on your ESX/i hosts. You can also run it to check service account credentials. It can find valid service accounts on vCenter and all of its managed hosts or on a single host.
• enginebuilder.py: This is a tool that you run to automatically create the engine.conf configuration files. The engine.conf file is read by the engine and specifies the data to be collected in your environment. It provides information about three key areas; the target machine(s) to query, the type(s) of data to query, and the frequency at which to execute data collection actions. This tool takes a template file, engine.template, as input. Edit this template file to specify key information about your environment. Note: We recommend that you use enginebuilder.py especially when evaluating the Solution or when configuring the Solution for a large environment.
• credentials.pl: This is a tool you can use as the Splunkadmin user to obfuscate passwords in your engine.conf files. Before running the tool you need a working engine.conf file with the usernames and the passwords already in it. The usernames and passwords are the credentials for the service accounts you created for the vCenter and ESX/i hosts and they are used during installation to create the engine.conf and credentials.conf files.