Audience and Features

Audience

If you are a Solutions administrator or a Splunk technical user, then this document is for you. You are a Splunk user who has a good understanding of Splunk. You may also have some prior knowledge of virtualized environments.

You will download and install the Splunk app for VMware to work with Splunk. You will configure the app to collect data from your VMware environment , index it in Splunk, and then map it to the dashboards in the Splunk App for VMware.

As a user you:

• Know your environment and you know your data.
• Can download and install Splunk for VMware.
• Will get value from the views and dashboards.

Features

In this release of the Splunk App for VMware we provide a completely new back-end model for collecting data from your VMware environment and bringing that data into Splunk. The new data collection technique supports an easily scalable and maintainable environment.

The app continues to target the proactive monitoring and troubleshooting of your environment. You can identify issues quickly and easily and drill down to those issues using the dashboards.

Features of this release:

• A data collection engine, written in python, that makes calls to the VMware API.
• We only collect data directly from vCenter. We no longer make direct calls to ESXi hosts.
• ESXi log data is collected directly from the ESXi hosts using Syslog.
• A user interface driven data collection configuration process that has simplified the installation and configuration of the app.
• A scheduler to manage the distribution of data collection jobs to Data Collection Nodes (previously the Forwarder Appliance Virtual Machine). The scheduler can be configured from a single configuration dashboard and implements fault tolerance and load balances data collection across nodes.
• Use pre-built views showing tasks associated with hosts and events associated with data health, inventory views where you can monitor the components of your VMware environment, and performance views where you can monitor the performance of your hosts and virtual machines.
• We have default thresholds set for the VMware performance metrics collected by the App. The default number collected is approximately 24. You can easily configure the thresholds in the app to work for your specific environment or you can manually edit the sa_threshold.conf file.

What you should know before using the app

To get the App working in your environment, it helps if you:

• Can configure Splunk files on the command line.
• Know the Splunk Search Processing Language (SPL).
• Have some previous knowledge of how indexes, sources, source types, and field extractions work.
• Have used Splunk in an enterprise environment. Read the Splunk product documentation for more information on how to get started.
• Know VMware and that you understand your VMware infrastructure.