Splunk® App for VMware (Legacy)

Installation and Configuration Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.

Install the Perl API package into the FA VM

The following instructions describe how to download and install the vSphere SDK for Perl package (Perl SDK).

What to install

The vSphere SDK for Perl provides an easy-to-use Perl scripting interface to the vSphere API. Download the SDK from VMware's web site and install it into the FA VM for it to work correctly.

Splunk for VMware is compatible with vSphere 5.0, 5.0 update 1, and 5.1. The application can gather data from vCenter Server and ESXi hosts for these VMware environments. The instructions below explain how to download and install the "5.1" release of the vSphere SDK for Perl.

If you are already running an FA VM, you can check the version of the Perl SDK that you have installed by running the command:

/usr/bin/perl -MVMware::VIRuntime -e 'print $VMware::VIRuntime::VERSION'

If it is installed, the version number of the currently running FA VM is returned. If it is not installed at all, an error is returned.

Download and install the VMware vSphere SDK for Perl

  1. Power on the FA VM: If the Splunk Forwarder Appliance VM (FA VM) you deployed is not already powered on, use the vSphere Client to start it now.
  2. Get the FA VM's IP Address: You will need the IP address of the FA for later steps:
    • In the vSphere client, select the FA VM, then click the Summary tab. In the "General" panel, an IP address should be displayed. The FA contains VMware Tools, which makes the IP address known to vSphere.
    • If the IP address does not display in the Summary tab, you can get it manually by logging into the virtual console accessible using the vSphere Client.
    • Log into the FA VM using the password you set when you deployed it. If you did not change the password, you can use the default credentials:
    • username=splunkadmin and password=changeme
      
    • When logged in, run ifconfig to get the FA VM's IP address.
    • If you booted the FA using the default values (DHCP) but it did not find a DHCP server, the FA may not be assigned an IP address. To correct this problem assign the FA a static IP address. See "Set static IP addresses" in this manual for details on how to do this.
  3. Go to VMware's web site: To download the SDK package, create or log in to your user account on the VMware site. You must have a user account to download the software. We recommend that you download the .tar.gz file to a location accessible by the FA VM via the network (such as a shared network drive, a nearby server, or your local laptop or desktop). Using a web browser, go to:
  4.  http://www.vmware.com/support/developer/viperltoolkit/
  5. Download the correct SDK version:
    • Choose "Release 5.1" on the drop-down menu and click the "Download" link.
    • You will need to login using your VMware web site account (or create one, then log in).
    • Accept the "End-User License Agreement" by clicking "yes".
    • On the Download page, click the "Use Web Browser" radio button, then choose the "gz" link in table row labelled "vSphere SDK for Perl - 64-bit Linux Installer".
    • Your web browser should download the Linux 64-bit PerlSDK package, version 5.1. The file name is VMware-vSphere-Perl-SDK-5.1.0-780721.x86_64.tar.gz.
  6. Transfer the SDK file to the FA VM: When you have a local copy of the package, you can then use a file transfer program such as scp or WinSCP to transfer the tar.gz file to your FA VM. Transfer the vSphere SDK package file into the /home/splunkadmin/packages directory as the splunkadmin user.
  7. For example, assume the destination FA's IP address is 192.168.10.10. Run scp like this (you will be prompted to supply a password for the splunkadmin user):

    scp VMware-vSphere-Perl-SDK-5.0.0-615831.x86_64.tar.gz splunkadmin@192.168.10.10:/home/splunkadmin/packages
    

    Note: If you cannot transfer the Perl SDK file, check that the network settings for your FA are properly configured. Possible problems can include:

    • VLAN misconfiguration for the VM
    • incorrect network settings for the Linux OS inside the FA
    • network infrastructure problems

    See "Troubleshooting virtual machine network connection issues" to help diagnose the problem.

  8. Log into the FA VM as the splunkadmin user: SSH as the splunkadmin user into the FA (or log into the virtual machine console). Verify that the Perl SDK package was transferred correctly by changing into the directory where you transferred the file and seeing if it's there (preferably in /home/splunkadmin/packages).
  9. cd packages
    ls
    

    You should see the vSphere Perl SDK file listed.

  10. Extract and install the Perl SDK package:
    1. Untar the file to extract the Perl SDK package
    2. tar -xzvf VMware-vSphere-Perl-SDK-5.1.0-780721.x86_64.tar.gz
      
    3. Change directories into the the vmware-vsphere-cli-distrib folder. This is the install folder.
    4. cd vmware-vsphere-cli-distrib
      
    5. Run the installation script (you may be asked for the splunkadmin user's password):
    6. sudo ./vmware-install.pl
      
    7. When prompted, accept the installation defaults.
  11. Validate your Perl SDK install: Now that your vSphere SDK for Perl installation is complete, you can verify the installation using the example instructions below.

Verify that the Perl API package is installed

Test the connection against a vCenter Server or and ESX/i host for which you have credentials. This example assumes that you have a VC machine located and reachable via the network at 192.168.20.20. You will be prompted for a username and password to access VC. The credentials are the same as those you use to log into the VC via the vSphere Client. Run the following commands on the FA:

cd /usr/lib/vmware-vcli/apps/general
./connect.pl --url https://192.168.20.20/sdk/webService

If the script prints out "Connection Successful," you have validated that the Perl SDK is installed correctly.

Last modified on 13 November, 2012
Configure default properties for the FA VM   Configure forwarding

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 2.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters