About the Splunk App for VMware

The Splunk App for VMware provides visibility into performance metrics, logs, tasks, events, and topology from hosts, virtual machines, and virtual centers. It provides a real-time picture of the health of the environment, identifying performance and capacity bottlenecks.

In production, the Splunk App for VMware is typically a portion of the overall deployed solution. Splunk Enterprise monitors the health of dependencies in a VMware environment, including log and performance data from the following sources:

• Storage for data stores, such as SAN or NAS
• Network devices providing the networking backbone of the virtualization environment
• Authentication logs from sources such as Active Directory, LDAP, and so on
• DNS, DHCP, BootP logs
• Operating system and application logs from virtual machines

Distributed installation

Use the tables below to determine where and how to install the Splunk app for VMWare in a distributed deployment of Splunk Enterprise.

Splunk instance type	Supported	Required	Comments
Search Heads	Yes	Yes	Install this app to all search heads where VMWare knowledge management is required.
Indexers	Yes	Yes	Required monitor VMWare data output.
Heavy Forwarders	Yes	Yes	Required if you use a heavy forwarder rather than a light or universal forwarder to monitor VMWare syslog output.
Universal Forwarders	Yes	Yes	Required if you use a universal forwarder rather than a light or heavy forwarder to monitor VMWare syslog output.
Light Forwarders	Yes	Yes	Required if you use a light forwarder rather than a universal or heavy forwarder to monitor VMWare syslog output.

Supported VMware operating environments

Use the below table to identify which operating environment works with each Splunk platform component within the Splunk app for VMware.

Component	Linux Supported	Windows Supported
Search Head	X
Indexer	X	X
DCN	X
Forwarder (Universal, Heavy, Light)	X	X

Distributed deployment compatibility

This table provides a quick reference for the compatibility of the splunk app for VMWare with Splunk distributed deployment features.

Distributed deployment feature	Supported	Comments
Search Head Clusters	Yes	Learn about VMWare search head clustering configuration.
Indexer Clusters	Yes	Use the cluster master to deploy your technology add-on packages.
Deployment Server	Yes	Learn about using the deployment server.

Configure a complex deployment

See the Configuration Guide for instructions on using Splunk App for VMware in a complex Splunk Enterprise deployment.

• Deploy the app in a indexer cluster deployment
• Create a custom data collection node