Platform and hardware requirements

Splunk App for VMware works on Splunk platform instances deployed in a *nix environment. Windows is not a supported operating system for this app. See System requirements in the Splunk Enterprise Installation Manual.

Plan your deployment according to the capacity planning guidelines in Splunk Enterprise capacity planning.

The Splunk App for VMware supports vCenter Server systems in Linked Mode. Splunk App for VMware collects API data for vCenter Server systems in a linked pool after you add them to the Collection Configuration dashboard in the Splunk Add-on for VMware. The Splunk Add-on for VMware does not recognize vCenter Servers in a linked pool that are not included in the data collection configuration.

If your deployment includes NetApp devices, install and configure Splunk App for NetApp Data ONTAP before you install Splunk App for VMware. See Prepare your Splunk App for NetApp.

The image shows how VMware is installed across a Splunk platform deployment.

Supported browsers

• Mozilla Firefox
• Microsoft Internet Explorer 9 and 10
• Apple Safari
• Google Chrome

The Splunk App for VMware does not support Internet Explorer 8 or Internet Explorer 9 Compatibility Mode.

Splunk App for VMware Installation Prerequisites

Installation of the Splunk App for VMware has the following prerequisites.

Prerequisite	Description
Splunk platform	A configured and ready to use Splunk platform environment.
A search head that runs on a 64-bit Linux operating system.	Your Splunk environment can be a single-instance deployment, or a deployment with a dedicated search head and one or more indexers.
A Splunk platform license	A default Splunk platform configuration with a licensing volume that can support approximately 300MB of data per host per day.
Use of a supported version of VMware vCenter Server to manage hypervisors.	Splunk App for VMware integrates with a vCenter Server and the hypervisors it manages. Environments with Windows-based vCenter and/or Linux-based vCenter Server Appliance are supported. ESXi servers that are not managed through vCenter are not supported.
Installation and configuration of the Splunk Add-on for VMware	Installation of the Splunk Add-on for VMware is necessary to collect and transform data from VMWare vCenters, ESXi hosts and Virtual Machines. See Installation and Configuration of the Splunk Add-on for VMware for installation and configuration information.
Installation and configuration of the Splunk OVA for VMware	The Splunk OVA for VMware collects and harnesses Data Collection Node (DCN) data from the virtualization layer to enable functionality with Splunk IT Service Intelligence, the Splunk Add-on for VMware and the Splunk App for VMware. See Installation and Configuration of the Splunk OVA for VMware for DCN installation and configuration information.

Component version compatibility

See the table to identify component version compatibility for your Splunk VMware deployment.

Compatible Splunk platform version	Compatible Splunk App for VMWare version	Compatible vCenter version	Compatible vSphere version	Compatible ESXi version	Compatible SA-Hydra version	Compatible SA-Utils version
6.2.0 through 6.4.3	3.2.1 to 3.3.0	5.0 to 6.0	4.1, 5.0, 5.0 Update 1, 5.1, 5.5, 5.5a, 6.0	4.1, 5.0, 5.0 Update 1, 5.1, 5.5 on 64-bit x86 CPUs, 5.5 update 1 and above.	4.0.2 and above	3.5.0, 3.7.0
6.3 to 6.5	3.3.1	5.0 to 6.0	4.1, 5.0, 5.0 Update 1, 5.1, 5.5, 5.5a, 6.0	4.1, 5.0, 5.0 Update 1, 5.1, 5.5 on 64-bit x86 CPUs, 5.5 update 1 and above.	4.0.2 and above	3.5.0, 3.7.0

Data volume requirements

In a typical environment, approximately 250 MB and 350 MB of data can be collected per host per day from your environment. This number varies depending on the volume of log data you collect, and the number of virtual machines that reside on a host. See the information below for further details.

Collected data type	Data volume
Total vCenter logs	15 MB of data per host per day per vCenter. For example, 750MB in a 50 host environment.
ESXi host logs	185 MB of data per host per day. (In a typical environment this number can range from 135MB to 235M of data, but it can vary widely depending on your environment).
Total API data per host	10 MB of data per host per day.
Total API data per virtual machine	3 MB of data per day.

Scheduler requirements

The Splunk App for VMware uses the Splunk Add-on for VMware to install and manage the Distributed Collection Scheduler (previously contained in the Splunk App for VMware component bundle), and to deploy the python script splunk_for_vmware_setup.py that collects DCN details, such as DCN URI, username, and password information from the Collection Configuration page, before sending them to SA-Hydra.

For single deployments of the VMware app scheduler, see the Splunk Enterprise search head hardware recommendations.

If you have Splunk App for NetApp ONTAP installed, it also uses the Distributed Collection Scheduler. See Prepare Splunk App for NetApp Data ONTAP of the Splunk App for NetApp Data ONTAP manual.