Splunk® App for VMware

Configuration Guide

Acrobat logo Download manual as PDF


On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of VMW. Click here for the latest version.
Acrobat logo Download topic as PDF

Splunk App for VMware component reference

Install components

This table describes where to install the individual components of Splunk App for VMWare in your distributed environment.

Component Search head Scheduler Indexer DCN ESXi log Fwd vCenter log Fwd
Splunk_TA_vmware
Splunk_TA_esxilogs
Splunk_TA_vcenter
SA-VMW-LogEventTask
SA-VMW-Licensecheck †
SA-VMW-Performance
SA-VMW-HierarchyInventory
splunk_for_vmware
SA-Hydra
SA-Utils
SA-Threshold

† Splunk App for VMware includes the SA-VMW-Licensecheck package. This is a known issue. Refer to the Installation Guide for instructions on how to remove this package to avoid benign licensing error messages.

†† Install SA-Utils and SA-Hydra on the Splunk indexers to stop modular input introspection from failing. This is a workaround to a known issue. These components do not affect the operation of your indexers.

Reference this table to see the Splunk App for VMware components that are installed and where the components get installed in the Splunk Enterprise and VMware infrastructure.

Component name Description
Search head If you have a dedicated search head, install all of the components on it. Be sure to install SA-Hydra and SA-utils as you can not schedule jobs without them.
Indexer Install all TA components on a dedicated indexer.
Data Collection Node The data collection node OVA ships with all components installed on it. To build your own data collection node, install Splunk_TA_vmware on the DCN.
Esxi host Install the log forwarding technology on the ESXi host. If you use an intermediate heavy forwarder to forward logs, install Splunk_TA_esxi_logs on the forwarder.
vCenter server Only install the log forwarding technology on the vCenter server. If you use a universal forwarder or light forwarder to forward vCenter logs, install TA_vcenter on it as it contains scripts that configure the inputs.conf.
License Master Follow detailed instruction to set a VMware license to work with a remote license master.

Component locations

Component name Description
Splunk app for VMware This component contains the UI components and knowledge objects of the app. Install it on the indexers and search heads in your VMware environment. It contains the following components in etc/apps:
  • SA-Utils
  • SA-Hydra
  • SA-Threshold
  • SA-VMW-Performance
  • SA-VMW-HierarchyInventory
  • SA-VMW-Licensecheck
  • SA-VMW-LogEventTask
  • splunk_for_vmware
  • Splunk_TA_esxilogs
  • Splunk_TA_vmware
  • Splunk_TA_vcenter

etc/deployment-apps contains the following components:

  • SA-Utils
  • SA-Hydra
  • Splunk_TA_vmware
  • Splunk_TA_vcenter
  • Splunk_TA_esxilogs
Splunk TA for VMware vCenter (Splunk_TA_vcenter) This component collects vCenter log data and forwards it to the indexer(s) in your environment. Install it on the Splunk Forwarder (UF/HF) running on your vCenter machines. If you use a light forwarder, you do not need to use this component.
Splunk forwarder for VMware (Splunk_TA_vmware) Use this component to create your own data collection node (DCN). It is shipped as part of the pre-configured OVA. When creating your own data collection node install it on a Splunk light forwarders or heavy forwarder on your data collection node. This app component makes API calls to vCenter to collect VMware API data and forwards that data to your Splunk indexer/search head. This data includes performance, inventory, hierarchy, and tasks and event data. The DCN collects API data directly from vCenter. The data collection node does not make API calls to ESXi hosts.
The data collection node OVA This is the pre-configured virtual machine distributed as an OVA to collect API data from your environment. This image of a centOS virtual machine includes the following components:
  • SA-Utils
  • SA-Hydra
  • Splunk_TA_vmware
  • Splunk_TA_vcenter
Last modified on 15 September, 2015
 

This documentation applies to the following versions of Splunk® App for VMware: 3.1.1, 3.1.2, 3.1.3, 3.1.4


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters