Splunk® App for VMware (Legacy)

Installation and Configuration Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.

Clean up older installations

If you have Splunk for VMware 1.0.2 installed and deployed in your environment and you want to upgrade to version 2.0, you can overwrite the current installation with the new installation if you have not manually customized your app environment.

Do not overwrite your installation and be sure to save your domain add-ons from the current Splunk for VMware version that you have installed (so that they are preserved when you install Splunk for Vmware 2.0), if you have:

  • manually changed the search head
  • manually added views to the domain add-ons
  • manually changed existing views
  • modified the indexes.

Changes made to the App from within the App environment are stored within the App and are automatically preserved during the upgrade process. Modifications you make to files outside of the app must be preserved manually.

During the upgrade process you will have a choice of deleting/disabling the domain Add-ons from the 1.0.2 version of the App. Removing them frees up a small amount of disk space.

Remove the Splunk App for VMware

To remove the Splunk App for VMware from all of your search heads/indexers:

  1. Stop Splunk on all search heads/indexers where the Splunk App for VMware was installed.
  2. Copy your $SPLUNK_HOME/etc/apps/splunk_for_vmware/local directory to a temporary location. The local directory contains all of the customizations that you made in the App (custom views, saved searches, macros, and so on).
  3. Go to $SPLUNK_HOME/etc/apps/splunk_for_vmware to locate the App and remove the entire App directory and all of its sub-directories on all of your search heads / indexers.
  4. Remove all of the old VMware data on all of your search heads/indexers:
    splunk clean eventdata vmware -f
  5. You can now install Splunk for VMware 2.0 on your search heads/indexers. See the Splunk for VMware Installation and Configuration Guide for detailed instructions. If you do not want to install Splunk for VMware, you can start your Splunk instance on all of your search heads/indexers now.

Remove the Splunk Add-on for vCenter

To remove the Splunk Add-on for vCenter from your vCenter Server forwarders:

  1. On the vCenter Server machines where the previous Splunk Add-on for vCenter version was installed, shut down the Splunk forwarder.
  2. If you created an inputs.conf.template file (containing your VC instance name) in $SPLUNK_HOME/etc/apps/splunk_for_vmware_vcenter/local, copy it to a temporary location.
  3. Remove the entire Add-on directory, $SPLUNK_HOME/etc/apps/splunk_for_vmware_vcenter , and all of its sub-directories on all of your vCenter Servers.
  4. You can now install Splunk for VMware 2.0 on your vCenter forwarders. See the Splunk for VMware Installation and Configuration Guide for instructions on how to do this. If you do not want to install Splunk for VMware 2.0, start the Splunk forwarder on all of your vCenter Servers now.

Shut down and de-commission the Splunk FA VM

To shut down and de-commission the Splunk FA VM:

  1. Log into the FA VM as the “splunkadmin” user.
  2. Stop splunk in the FA VM:
    splunk stop
  3. Copy all custom configurations that you made in your FA VM (for example, outputs.conf, engine.conf, inputs.conf) and save a copy of your “local” config files to a temporary location. You can find all the files in #: $SPLUNK_HOME/etc/apps/splunk_for_vmware/local or $SPLUNK_HOME/etc/system/local.
  4. Shutdown the OS and halt operation:
    sudo shutdown –h now
  5. Your previous FA VM version is now de-commissioned and you can deploy a new version of the FA VM. See the Splunk for VMware Installation and Configuration Guide for instructions on how to install Splunk for VMware 2.0
Last modified on 17 January, 2013
How to upgrade   engine.conf file structure

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 2.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters