Install on your search head or indexer

This topic covers the instructions for the installation of the Splunk App for VMware on a search head or combined indexer and search head configuration. You can also install the app on a dedicated indexer. Wherever there is a difference in the install instructions for the dedicated indexer, it is noted.

Note: Install the Splunk App for VMware on each Splunk indexer and search head in your Unix or Linux environment using the same user account that you used to install Splunk.

See the Component Reference table in this manual to check that you have the correct app components installed.

To install the App:

For each indexer/search head:

1. Install splunk_app_vmware-<version>-<build_number>.zip. Get the file splunk_app_vmware-<version>-<build_number>.zip and put it in $SPLUNK_HOME.
2. In $SPLUNK_HOME unzip the app package.

   unzip splunk_app_vmware-<version>-<build_number>.zip

3. Verify that all of the apps and sub directories are copied correctly. If the app installed correctly, the following files are shown in $SPLUNK_HOME/etc/apps:

   SA-Utils/…

   SA-Hydra/…

   SA-Threshold/…

   SA-VMW-HierarchyInventory/…

   SA-VMW-Licensecheck/…

   SA-VMW-LogEventTask/…

   SA-VMW-Performance/…

   Splunk_TA_vcenter/…

   splunk_for_vmware/…

   Splunk_TA_vmware/…

   Splunk_TA_esxilogs/…

   1. Note that on a dedicated indexer, for a valid install, the following files must exist in $SPLUNK_HOME/etc/deployment-apps:

      /SA-Utils/…

      /SA-Hydra/…

      /Splunk_TA_vcenter/…

      /Splunk_TA_vmware/…

      /Splunk_TA_esxilogs/...

4. Restart Splunk in all locations where the app is installed. For instructions, see "Start and stop Spunk" in the Splunk ‘'Admin‘' Manual.
5. On the search head, in a browser:
   1. log in to Splunk Web and enter the IP address and port number of the OS hosting your search head:

      https://<ipaddress>:8000/

      Note that after deploying the app on your search use

      https

      not

      http

      to access the dashboards.
   2. Select Splunk App for VMware from the Apps menu.
   3. If this is a first time install, you are automatically redirected to the Setup page. Accept the default settings on the Setup screen, then click Save. For most installations the default settings work.
6. On the search head (combined indexer search head) configure user roles for users of the app. This is standard Splunk user role configuration. In Settings go to Access controls, then Users and assign roles to each user. The app contains two default user roles:
   • the splunk_vmware_admin role. Add the splunk_vmware_admin role to "admin" account. The "admin" user must have the splunk_vmware_admin role to run scheduled searches properly. The splunk_vmware_admin role allows the user to configure the Splunk App for Vmware for data collection.
   • the splunk_vmware_user role. This role gives you permission to use the Splunk App for VMware. It does not allow you to make configuration changes.
   • See User Roles in the User Manual for more information.
7. Now that the App is installed, configure each of your Splunk indexers to listen for data on a (forwarding/receiving) port. Set up receiving on you indexer. By convention, receivers listen on port 9997, but you can specify any unused port. For more information see "Set up receiving" in the Splunk ‘'Forwarding data‘' manual.
8. See the Component Reference table in this manual to check that you have the correct app components installed.