Install on your search head or indexer
This topic covers the instructions for the installation of the Splunk App for VMware on a search head or combined indexer and search head configuration. You can also install the app on a dedicated indexer. Wherever there is a difference in the install instructions for the dedicated indexer, it is noted.
Note: Install the Splunk App for VMware on each Splunk indexer and search head in your environment using the same user account that you used to install Splunk.
To install the App:
For each indexer/search head:
- Install
splunk_app_vmware-<version>-<build_number>.zip
. Get the filesplunk_app_vmware-<version>-<build_number>.zip
and put it in$SPLUNK_HOME
. - In
$SPLUNK_HOME
unzip the app package.unzip splunk_app_vmware-<version>-<build_number>.zip
- Verify that all of the apps and sub directories are copied correctly. If the app installed correctly, the following files are shown in
$SPLUNK_HOME/etc/apps
:SA-Utils/…
SA-Hydra/…
SA-Threshold/…
SA-VMW-HierarchyInventory/…
SA-VMW-LogEventTask/…
SA-VMW-Performance/…
Splunk_TA_vcenter/…
splunk_for_vmware/…
Splunk_TA_vmware/…
Splunk_TA_esxilogs/…
- Note that on a dedicated indexer, for a valid install, the following files exist in
$SPLUNK_HOME/etc/deployment-apps
:/SA-Utils/…
/SA-Hydra/…
/Splunk_TA_vcenter/…
/Splunk_TA_vmware/…
/Splunk_TA_esxilogs/...
- Restart Splunk in all locations where the app is installed. For both Windows and Unix instructions, see "Start and stop Spunk" in the Splunk ‘'Admin‘' Manual.
- On the search head, in a browser:
- log in to Splunk Web and enter the IP address and port number of the OS hosting your search head:
https://<ipaddress>:8000/
Note that after deploying the app on your search usehttps
nothttp
to access the dashboards. - Select Splunk App for VMware from the Apps menu.
- If this is a first time install, you are automatically redirected to the Setup page. Accept the default settings on the Setup screen, then click Save. For most installations the default settings work.
- log in to Splunk Web and enter the IP address and port number of the OS hosting your search head:
- On the search head (combined indexer search head) configure user roles for users of the app. This is standard Splunk user role configuration. In Manager, go to Access controls, then Users and assign roles to each user. The app contains two default user roles:
- the splunk_vmware_admin role. Add the splunk_vmware_admin role to "admin" account. The "admin" user must have the splunk_vmware_admin role to run scheduled searches properly. The splunk_vmware_admin role allows the user to configure the Splunk App for Vmware for data collection.
- the splunk_vmware_user role. This role gives you permission to use the Splunk App for VMware. It does not allow you to make configuration changes.
- Now that the App is installed, configure each of your Splunk indexers to listen for data on a (forwarding/receiving) port. Set up receiving on you indexer. By convention, receivers listen on port 9997, but you can specify any unused port. For more information see "Set up receiving" in the Splunk ‘'Forwarding data‘' manual.
Configure Operating System properties | Considerations when using tsidx namespaces |
This documentation applies to the following versions of Splunk® App for VMware (Legacy): 3.0, 3.0.1, 3.0.2
Feedback submitted, thanks!