Install the App

Install the App on each Splunk indexer and search head in your environment using the same user account that you used to install Splunk on your systems.

Before you install the App you must have:

• Splunk indexers or search heads installed on one or more systems in your environment.
• Splunk App for VMware downloaded from Splunkbase to a location in your environment.

To install Splunk App for VMware

1. Transfer the App package file splunk_app_vmware-<version>-<build_number>.zip to a temporary location on each indexer and search head in your environment. Create a temporary directory, for example /tmp on *nix machines or C:\Windows\Temp on Windows machines.
2. Unzip the App package in the temporary directory. This creates a new "etc" directory.

   unzip splunk_app_vmware-<version>-<build_number>.zip

To install the App on each dedicated indexer in your environment:

1. If you are running both search heads and indexers on the same Splunk instance, Go to the next section "To install the App on each search head (or combined indexer and search head) in your environment:"
2. Copy all of the apps in the etc/deployment-apps folder onto each of the indexers. ($SPLUNK_HOME/etc/apps). Use recursive copy to copy all of the files and all of the sub-directories.:

   etc/

   apps/deployment-apps/

   Splunk_TA_vcenter/…

   Splunk_TA_vmware/…

3. Look in $SPLUNK_HOME/etc/apps and verify that all of the apps were copied correctly.
4. Go to $SPLUNK_HOME/etc/apps/Splunk_TA_vcenter/default.
5. Look at your inputs.conf file and check that it is set up as follows:

   [script://.\bin\SetHost.bat]

   disabled = true

6. Restart Splunk on each indexer. For both Windows and Unix instructions, see "Start and stop Spunk" in the Splunk Admin Manual.
7. Now that the App is installed you must configure each of your Splunk indexers to listen for data on a (forwarding / receiving) port. See "Set up receiving" in the Splunk product documentation.

To install the App on each search head (or combined indexer and search head) in your environment:

1. Copy the contents of the apps directory in the temporary etc/apps folder into the apps directory of your Splunk install ($SPLUNK_HOME/etc/apps). Use recursive copy to copy all of the files and all of the sub-directories.

   etc/

   apps/

   SA-Utils/…

   SA-Threshold/…

   SA-VMW-HierarchyInventory/…

   SA-VMW-LogEventTask/…

   SA-VMW-Performance/…

   Splunk_TA_vcenter/…

   Splunk_TA_vmware/…

   splunk_for_vmware/…

2. Look in $SPLUNK_HOME/etc/apps to verify that all apps were copied correctly.
3. Restart Splunk. For both Windows and Unix instructions, see "Start and stop Spunk" in the Splunk Admin Manual.
4. Log into Splunk Web on the search head.
5. Open a browser and enter the IP address and port number of the OS hosting your search head: http://<ipaddress:8000/>
6. The Splunk Home page is displayed showing all installed apps. Select Splunk App for VMware from the list. The app is also available from the App menu on the Home screen.

   

7. If this is a first time install, you are automatically redirected to the Setup page. Complete the details and continue.
8. Click save on the Setup page.
9. Now that the App is installed you must configure each of your Splunk indexers to listen for data on a (forwarding / receiving) port. See "Set up receiving" in the Splunk product documentation.

Spunk is almost ready to receive VMware environment data. You must configure your indexers to handle vCenter Server log files. For more information, see Set the timezone for vCenter log files in this manual.