Install the FA VM

You will deploy the Splunk Forwarder Appliance for VMware into vSphere using the vSphere client.

Deploy the the FA VM into your vSphere environment:

1. On your Windows machine, open the vSphere client and log into vCenter Server
2. Invoke the OVA template wizard. Click File > Deploy OVF Template.
3. In the Deploy OVF Template wizard click Deploy from a file or URL, then click Browse…
4. Browse to the location of your FA ova file, splunk_for_vmware_forwarder_appliance_1.0.2-120926a.ova, then click Next.

   Note: You can not download the file directly from the URL as, before doing so, Splunkbase requires you to be authenticated via a supported web browser.

5. Review the OVF template details, then click Next
6. In the Name and Location screen provide a new name for the FA VM, though you can use the default FA VM name.
7. Select a datacenter or folder as the deployment destination for the FA VM, then click Next.
8. On the Host / Cluster screen, select the specific host or cluster where you would like to run the FA VM, then click Next.
9. If resource pools are defined in the host or cluster, choose a resource pool for the FA VM.
   1. Depending upon your vCenter software version and the permissions you used to log into the vCenter), you can either place the FA VM in the host or cluster (not in a resource pool) or choose a specific pre-defined resource pool for the FA VM. The cluster or resource pool must have sufficient resources to support the FA VM.
10. In the Datastore screen, choose the datastore where you want the VM and its filesystem to reside. The datastore must be at least 20 GB. Click “Next”.
11. On the Disk Format screen, select either Thin or Thick Provisioning, then click “Next”. We recommend thick provisioning for the FA VM as it is fairly small and it's best to pre-allocate the storage used for log file collection.
12. On the Network Mapping screen, to specify the networks that you want the deployed template to use. Use the Destination Networks drop-down menu to map your FA .ova template to one of the networks in your inventory.

    

13. Validate your selections in the Ready to Complete dialog, then select Next to begin deployment.
14. Once deployed, click Close to complete the installation and exit the wizard.
15. Locate the FA VM in the vSphere Client tree view.
16. Right-click on the FA VM and choose Power > Power On from the menu to start the FA VM. When you power on the FA, Splunk starts automatically even though the VMware data collection mechanism is not configured. By default, the FA VM boots and gets its network settings via DHCP. You can keep this default setting or you can set a static IP address. If you use DHCP, check the Summary tab in the vSphere client to get the IP address of the FA VM.
17. Configure the FA VM to get data from your VMware environment and then forward the data to the port on which the Splunk indexer(s) is configured to receive data. For more information, see "Configure engine.conf" in this manual.