Configure and deploy the Splunk App for VMware

Configure and deploy the Splunk App for VMware either as a single-server deployment or as a distributed deployment.

Single-server Splunk Enterprise deployment

In a single-server deployment, install Splunk App for VMware on the main Splunk indexer or search head. The data collection node communicates with this Splunk Enterprise instance to collect vCenter Server API data. This is the basic installation we cover in the Installation Guide.

Distributed Splunk Enterprise deployment

In a distributed deployment, install Splunk App for VMware on the search head. Install the add-ons on your indexers. The data collection node forwards the data to the indexers. Use the search head to search the data and to view the app dashboards.

An example simple deployment of Splunk App for VMware

A typical deployment contains the following components.

Component	Description
vCenter Server	The VMware vCenter Server system that manages your virtual infrastructure. It monitors and manages the ESXi hosts in your environment. The Splunk App for VMware uses the VMware vSphere API to get data from vCenter Server. The data collection node communicates with the vCenter Server API to collect data. Install a Splunk Universal Forwarder on vCenter Server to collect vCenter Server data.
ESXi hosts	Virtual hosts that run on the VMware ESXi hypervisor architecture. vCenter Server monitors and manages these hosts.
Splunk Enterprise search head	Install the Splunk App for VMware on a search head running Splunk Enterprise version 6.2.0 or later, and use Splunk Web to run searches on the data and view the app dashboards. The default scheduled searches run on the search head to query data on the indexers. The search head stores the search results for later use or displays the results in the app dashboards. The app contains the UI components, the searches, and the indexing definitions for your vCenter Server data. The app installation includes the Distributed Collection Scheduler (SA-Hydra version 4.0.2) and SA-Utils version 3.5.0. Splunk App for VMware cannot schedule jobs without the SA-Hydra component.
Splunk indexer	A Splunk Enterprise instance, version 6.2.0 or later. Install all of the Splunk App for VMware add-ons on one or more indexers.
Data Collection Node (DCN)	Makes API calls to the vCenter Server to collect data from it. The DCN must have network access both to your vCenter server and the search head that hosts the Distributed Collection Scheduler. You can create a DCN or use the Splunk-provided OVA template to deploy a Data Collection Node in your VMware vSphere environment. The DCN OVA file is preconfigured with: a version of CentOS that is supported by Splunk Enterprise version 6.2.0 or later a Splunk Enterprise heavy forwarder, version 6.3.1 or later. the data collection components, SA-Hydra version 4.0.2, SA-Utils version 3.5.0, and Splunk_TA_vmware.
Distributed Collection Scheduler (DCS)	Runs on the Splunk search head where you installed the Splunk App for VMware. Using one or more Data Collection Nodes, it orchestrates API data collection from vCenter server. After you deploy a DCN, use the Collection Configuration dashboard to configure the DCN for data collection. In large, complex Splunk Enterprise deployments, you can install the Distributed Collection Scheduler on a dedicated Splunk Enterprise instance to distribute the data collection load.

What you can do with your deployment using this manual

Once you have the deployment described above, use this Configuration Guide to build a deployment that best meets your needs.

• Scale your deployment by adding data collection nodes.
• Deploy cluster deployments.
• Configure the data that gets collected and optimize collection performance.
• Configure performance metrics.