Splunk® App for VMware (Legacy)

Installation and Configuration Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.

engine.conf file structure

The engine.conf configuration file consists of one or more stanzas, or sections. Each stanza begins with a stanza header, designated by square brackets. Following the header is a series of attribute/value pairs that specify configuration settings. Depending on the stanza type, attributes can be required or optional.

engine.conf follows the format of having a stanza header with a unique_stanza_name followed by a number of "key = value" pairs. Comments must be on their own line and start with the "#" character. They cannot be placed at the end of a line. Use alphanumeric characters and dashes for stanza names. Start the stanza name with an alphabetic character. Never use '[' or ']' in the name.

The following example illustrates the basic engine.conf stanza format:

[<unique_stanza_name>]
<key-1>=<value-1>
<key-2>=<value-2>

Individual stanzas in this file correspond to vCenter machines or ESX/i hosts from which you want to collect data. Within a stanza, actions correspond to the type(s) of data you want to collect, while intervals and other settings correspond to the data gathering frequency. This file defines the resources from which to collect data about your VMware environment:

  • The target machine(s) to query.
  • The type(s) of data to query.
  • The frequency at which to execute data gathering actions.

An action is a setting that informs engine.pm of the type of data to be collected for a particular resource. An action keyword exists for each type of data that can be collected by Splunk for VMware. A given target machine can have a number of actions associated with it. In this example, we use a single stanza to get all 3 types of data from each ESX/i host, as shown by the actions HierarchyDiscovery, PerfDiscovery, and LogDiscovery:

[host1inVC1]
url = https://host1_in_vc1.company.com/sdk/webService
username = <esx_splunk_username>
password = <esx_splunk_password>
action = HierarchyDiscovery, PerfDiscovery, LogDiscovery
interval = 1

Important:

  • engine.conf attributes are case-sensitive. For example, the attribute host = host1 is not the same as HOST = host1. The first example is correct. The second example is not correct.
  • Each stanza in your engine.conf file must have a unique name. This is true even if you gather data for a given vCenter machine or ESX/i host using more than one stanza.
  • Underscores ("_") are not permitted in the stanza name.
Last modified on 24 September, 2012
Controlling data volumes   A simple engine.conf

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 1.0, 1.0.1, 1.0.2, 1.0.3, 2.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters