Splunk® App for VMware (Legacy)

Installation and Configuration Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.

Enginebuilder.py

Run enginebuilder.py to automatically create the engine.conf files that specify how data is collected in your VMware environment from vCenter. It reads the engine.template file that contains key information about your environment and it can also call logincreator.pl to check service account credentials.

When you run enginebuilder.py it:

  • Checks your login credentials on the vCenter server and ESX/i hosts.
  • Splits up your engine.conf files depending on the number of FA OVA files you have and depending upon your VM-to-host ratio.

Important: enginebuilder.py assumes that all ESX/i hosts in the host_csv field use the same service account username and password (hostuser, hostpwd). If your ESX/i hosts do not use the same service account credentials, you can:

  • run enginebuilder.py multiple times.
  • generate the FA VM configuration files manually.

Reference the table for more details about the enginebuilder.py tool.

Tool name enginebuilder.py
Location $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/bin
Prerequisites
  • Modify engine.template as needed in the $SPLUNK_HOME/etc/apps/local directory.
Inputs Your engine.template file.
Outputs engine.conf configuration files
Command line usage
  • Run enginebuilder.py from $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local ($ ../bin/enginebuilder.py <arguments>)
  • If you have only one FA use ../bin/enginebuilder.py -c
  • If you have multiple FAs each crawling 30 hosts, so a total of 60 hosts would create engine.conf files for this FA and a tar.gz for another FA. You will have to copy the generated tar.gz files to the respective FAs. ../bin/enginebuilder.py -c -f 30
  • If you want to limit the performance engine files to 10 hosts each. use ../bin/enginebuilder.py -c -l 10
  • The following is a combination of the previous two examples: ../bin/enginebuilder.py -c -f 30 -l 10
Arguments
  • -c: run a credentials check on the user names and passwords provided for vCenter server and ESX/i host(s) in your engine.template. Note: Do not use this argument if you are going to run credentials.pl.
  • -l: limit the number of hosts per performance engine.conf file, such that each performance engine.conf file is configured to 300 VMs. That is, if you have 30 VMs per host and 20 hosts (600 VMs), then you need to type -l 10 so that each performance engine.conf file applies to 300 VMs.
  • -f: Limit the number of hosts an FA OVA can crawl. If we assume that 4vCPUs and 8 GB of RAM is the resource setting per FA OVA, then each OVA of that specification should not crawl more than 40 hosts. Using -f 40 would create the correct number of FA conf files for each FA you are running. It will create all the conf files on the FA where this command has been run, and tar.gz files for every other FA. Copy the files to the other FAs via SCP. Make sure to change the host name in the engine.conf files after you have unpacked them on the other FAs.
  • -u: Run enginebuilder.py with the -u on a FA VM where you SCPed a tar.gz onto after you had run the -f option on your original FA VM. Example: If the tar.gz was called FA1.tar.gz ../bin/enginebuilder.py -u 1 If the tar.gz was called FA2.tar.gz ../bin/enginebuilder.py -u 2
  • -h: Run enginebuilder.py with the -h help parameter to see all the available arguments. Example: ../bin/enginebuilder.py -h
Examples

Sample engine.template file that generates configurations using only the specified ESX/i hosts:

vcuser=splunkuservc
vcpwd=splunkuser123
vc=vc1.company.com
hostuser=splunksvc
hostpwd=splunkuser123
host_csv=esx1.company.com,esx2.company.com,esx3.company.com
perfInstanceData=OFF

Sample engine.template file that generates configs using all of the ESX/i hosts found in VC:

vcuser=splunkuservc
vcpwd=splunkuser123
vc=vc1.company.com
hostuser=splunksvc
hostpwd=splunkuser123
host_csv=*
perfInstanceData=OFF


Gather information for the engine.template file

Edit the engine.template file to include the following information:

Setting perfInstanceDataPerfTypeBlacklist
vcuser The username for the service account created to access vCenter.
vcpwd The password for the vcuser (for the service account created to access vCenter).
vc The IP or hostname of the vCenter Server.
hostuser The username for the service account created to access ESX/i hosts.
hostpwd The password for the hostuser (for the service account created to access ESX/i hosts).
host_csv A comma separated list of values containing ESX/i host IPs or hostnames. You can use“*” to generate files that cover ALL of the ESX/i hosts managed by the given vCenter.
perfInstanceData This option is set to OFF by default. When turned ON it provides fine-grained control over the amount and kinds of performance data that you want the engine to collect

How it works

  1. Edit the engine.template file with key information about your environment.
    You can include multiple VCs in the file.
  2. Run enginebuilder.py, which uses the engine.template file.
  3. enginebuilder.py generates all of your engine.conf and inputs.conf files.
    • It creates engine.conf files by data type: engine<datatype>.conf.
    • It creates inputs.conf with scripted inputs to start engine instances using engine.conf files.
  4. enginebuilder.py optionally runs the service account tool (logincreator.pl) to verify service accounts
    • It checks permissions on vCenter server and all ESX/i hosts
    • It runs logincreator.pl to verify accounts (it does not create or modify them)
    • you can run logincreator.pl by itself to create or verify logins. For more information, see Create service accounts in this manual.

Troubleshooting

If there are credential check errors, here are some things you can check to see if you can resolve them:

  1. Check your user names and passwords and ensure that you can connect to the vCenters and hosts using those credentials.
  2. Check that you have DNS configured for the FA.
  3. Check that you are on the same subnet as the vCenter server and ESX/i hosts.
  4. Check that this FA OVA has a unique IP address.
  5. Check that this FA has an IP address assigned to it.
Last modified on 31 May, 2013
Logincreator.pl   Credentials.pl

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 1.0.2, 1.0.3, 2.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters