Install UF or LF on each vCenter machine
You can use a Splunk UF or LF to forward the data from your vCenter Server to the Indexer.
To download the Universal Forwarder (UF)
- Go to
www.splunk.com
and click the Free Download button. - Select the Universal Forwarder link on the page. The Download Splunk Universal Forwarder page opens where you can select the forwarder version you need.
To download a Light Forwarder
- Go to
www.splunk.com
and click Free Download button to download a full version of Splunk. - Click on the Splunk version for your target OS to begin the download.
- When the download is complete, configure the Splunk instance as a LF.
Configure forwarding
Configure the forwarder on your vCenter Server machines to send data to your indexer(s) in the outputs.conf file. Do this for each forwarder installed on a vCenter machine. For more information about setting up forwarding for your indexers, see Configure forwarders with outputs.conf in the Splunk Distributed Deployment Manual.
For a single indexer configuration:
- Use the splunkadmin user to log into vCenter and enter the following:
splunk add forward-server <host>:<port>
- For example,
splunk add forward-server splunkindexer.company.com:9998
- Now enter the default Splunk credentials to log into the Splunk forwarder on the vCenter, or use the credentials you created. The default username is
admin
and the password ischangeme
. - Check that the indexer is active and that you can forward data to it. Run the command:
splunk list forward-server
.
- The indexer to which you are forwarding data is added the list of active forward servers.
You can now forward data from the vCenter to your indexer/search head.
To learn more about installing and configuring forwarders, in the Splunk Distributed Deployment Manual:
- See "Types of forwarders" .
- See Introducing the universal forwarder" .
- See "Deploy a forwarder" .
Go to Splunkbase | Install Sideview Utils on your search head(s) |
This documentation applies to the following versions of Splunk® App for VMware (Legacy): 1.0, 1.0.1, 1.0.2, 1.0.3, 2.0
Feedback submitted, thanks!