Splunk for VMware features

In this release of the Splunk App for VMware we provide a completely new back-end model for collecting data from your VMware environment and bringing that data into Splunk. The new data collection technique supports an easily scalable and maintainable environment.

The app continues to target the proactive monitoring and troubleshooting of your environment. You can identify issues quickly and easily and drill down to those issues using the dashboards.

Features of this release:

• A data collection engine, written in python, that makes calls to the VMware API.
• Data collection directly from vCenter. We no longer make direct calls to ESXi hosts.
• ESXi log data collection directly from the ESXi hosts using Syslog.
• A user interface driven data collection configuration process that has simplified the installation and configuration of the app.
• A scheduler that manages the distribution of data collection jobs to data collection nodes (previously the Forwarder Appliance Virtual Machine). The scheduler can be configured from a single configuration dashboard and implements fault tolerance and load balances data collection across nodes.
• Pre-built views showing tasks associated with hosts and events associated with data health, inventory views where you can monitor the components of your VMware environment, and performance views where you can monitor the performance of your hosts and virtual machines.
• Default thresholds set for the VMware performance metrics collected by the app. The default number collected is approximately 24. You can easily configure the thresholds in the app to work for your specific environment or you can manually edit the sa_threshold.conf file.