Splunk® App for VMware (Legacy)

Installation and Configuration Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.

How data is collected

How engine.pm gathers data

When gathering data from your VMware environment, engine.pm connects to each VC machine and ESX/i host that you want to monitor and gathers different types of data from each. How data is collected for ESX/i hosts depends on whether the host is managed (under vCenter Server) or unmanaged (runs independently of vCenter).

VMW HowitWorks.jpg

Splunk for VMware collects data from vCenter and the ESX/i hosts and maps the data to the dashboards and views in the the Splunk App for VMware. Using the Splunk App for VMware you can explore your data and deep dive into specific areas.

Data sets collected for managed resources

vCenter and managed ESX/i hosts

Data Type Dataset Description
Hierarchy engine.pm gets the entire hierarchy dataset.
inventory engine.pm gets the entire inventory dataset.
Performance engine.pm gets performance data for VC-specific objects (objects not seen in each ESX/i host). This includes the managed entity ClusterComputeResource.
Tasks engine.pm gets the entire task dataset.
Events engine.pm gets the entire events dataset.


Managed ESX/i hosts

Data Type Dataset Description
Hierarchy In addition to getting data from VC, it is also important to get the entire hierarchy dataset from each ESX/i host. Getting data from both enables “moid mapping” to occur.
Performance engine.pm gets the entire performance dataset.
Logs engine.pm gets the entire log dataset.


Data sets collected for unmanaged ESX/i hosts

Data Type Dataset Description
Hierarchy Collect the entire hierarchy dataset from each ESX/i host. Getting data from vCenter and the ESX/i hosts enables “moid mapping” to occur.
Performance engine.pm gets the entire performance dataset.
Logs engine.pm gets the entire log dataset.
Inventory engine.pm gets the entire inventory dataset.
Tasks engine.pm gets the entire task dataset.

engine.pm

engine.pm is the main data collection module inside the Forwarder Appliance Add-on. It is located in: $SPLUNK_HOME/etc/apps/splunk_for_vmware_appliance/bin It executes data discovery modules according to the specifications defined in engine.conf. engine.pm looks for a file named engine.conf by default in the splunk_for_vmware_appliance/local directory. Alternatively, you can specify a different configuration file name on the command line. Multiple engine.pm processes can run concurrently.

The engine.conf.spec file

The engine.conf.spec file documents the settings and values you can use in the engine.conf file. It is a reference document and is located in $SPLUNK_HOME/etc/apps/splunk_for_vmware_appliance/default in the Forwarder Appliance (FA VM):

Learn more

Last modified on 10 January, 2013
What data can I get   The data collection components

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 1.0, 1.0.1, 1.0.2, 1.0.3, 2.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters