Setup Requirements

Check that you have satisfied the setup requirements

On vCenter:

• Install the missing VMware WSDL files. vSphere 5.0 and 5.0 update 1 update are missing two WSDL files that are required for the app to make API calls to vCenter. Install the VMware WSDL files as documented in the vSphere Web Services SDK WSDL workaround in the VMware documentation.
  • The missing files are: reflect-message.xsd, reflect-types.xsd, but to be safe, just overwrite all. NOTE: The programdata folder under C:\ is usually a hidden folder.
• Check that you have a Universal Forwarder installed on the Windows vCenter machine and enable forwarding to forward the data to your central Splunk indexer. See "Install a Universal Forwarder on Windows" in the Forwarding Data manual.

On your indexer/search head:

• Check that you have Splunk Enterprise version 6.0.2 or later installed in a Unix or Linux environment.
• Check that you have the latest version of SA-Hydra (version 4.0.0) and SA-Utils (version 3.1.0).
• Check that your licensing volume can support approximately 300 MB per host per day. See "Splunk app for VMware indexing data volumes".
• Set up a receiving port (for example 9997) so that you can send data to it.
• Know the administration credentials for Splunk (search head and indexers).

Configure ESXi log collection

• Enable UDP and TCP ports on ESXi hosts.

Get a data collection node:

• Deploy the preconfigured OVA as a virtual machine in your environment, or create a data collection node.
• Resource your node correctly. See "Splunk data collection node resource requirements".

On the data collection node:

• For the pre-packaged OVA, know the default splunkadmin credentials (splunkadmin/changeme and root/changemenow).
• Check that you have Splunk Enterprise version 6.0.2 or later installed in a Unix or Linux environment.
• Check that you have the latest version of SA-Hydra (version 4.0.0) and SA-Utils (version 3.1.0).
• Set up forwarding to the indexers.