Splunk® App for VMware (Legacy)

Installation and Configuration Guide

Acrobat logo Download manual as PDF


On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Upgrade

This topic discusses how to upgrade the Splunk App for VMware to the latest version.

The Splunk App for VMware 3.1.0 runs on Splunk version 6.0.2 or later installed in a Unix or Linux environment. See the topic "How to upgrade Splunk" in the Splunk Enterprise documentation if you need to upgrade your Splunk instance. Review the "System Requirements" in this manual if you are not familiar with the requirements for getting started.

Why Upgrade

Upgrade to the latest release of the Splunk App for VMware to get:

  • Support for very large scale environments with a scalable and distributed data collection architecture for API data.
  • Support for Splunk versions 6.0.2 and later.
  • Support for the Splunk Common Information Model.
  • Enhanced licensing capabilities.
  • Fixed issues since the last software release.

Backup your existing deployment

Before you upgrade, we recommend that you backup your existing deployment. For more information about backing up your Splunk deployment, read the topics "Back up configuration information" in the Admin Manual and "Back up indexed data" in the Managing Indexers and Clusters Manual.

Upgrade a distributed deployment

To upgrade your distributed Splunk environment, read "Upgrade your distributed environment" in the Distributed Deployment Manual for instructions on how to do this with minimal impact.

Upgrade steps

Download the Splunk App for VMware 3.1.0 from Splunk Apps to a location in your environment. For instructions on how to do this, read "Download the Splunk App for VMware" in this manual.

Upgrade the data collection node

  1. Stop Splunk.
  2. Install splunk_forwarder_for_vmware-<version>-<build_number>.zip.Get the file splunk_forwarder_for_vmware-<version>-<build_number>.zip from the download package and put it in $SPLUNK_HOME.
  3. Unzip this file (the data collection node components) from $SPLUNK_HOME. The file automatically unzips into the $SPLUNK_HOME/etc/apps directory.
  4. Check that the data collection components SA-Utils, SA-Hydra, Splunk_TA_vmware, and Splunk_TA_esxilogs exist in $SPLUNK_HOME/etc/apps.
  5. Delete the file $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local/hydra_job.conf
  6. To upgrade the .ova for the DCN provided in the Splunk App for VMware version 3.0.1 release or below, do the following:
    1. $SPLUNK_HOME/bin/splunk createssl web-cert
    2. Update iptables in linux to enable port 8008. (8008 is the default port for the Gateway.)
  7. Start Splunk.

Upgrade the search head

  1. Stop the scheduler before performing an upgrade. You can do this by stopping Splunk on the search head, or you can stop the scheduler in the Collection Configuration page of the app.
  2. Install the Splunk App for VMware. Follow the instructions in the topic "Install Splunk App for VMware" in this manual.
  3. Once installed, start Splunk if you stopped it, or restart the scheduler in the Collection Configuration page of the app.

Validate your installation

Now that you have upgraded to the latest release, you can validate that the Splunk App for VMware is installed correctly and that data is coming in. In the Splunk App for VMware Installation and Configuration Guide, see the topic "Launch Splunk Web" for more information.

Last modified on 28 January, 2015
PREVIOUS
Collect VMware vCenter Server Linux Appliance log data
  NEXT
Collect data from your environment

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 3.1


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters