Platform and hardware requirements
Splunk App for VMware works on Splunk platform instances deployed in a *nix environment. Windows is not a supported operating system for this app.
The Splunk App for VMware supports vCenter Server systems in Linked Mode. Splunk App for VMware collects API data for vCenter Server systems in a linked pool after you add them to the Collection Configuration dashboard in the Splunk Add-on for VMware. The Splunk Add-on for VMware does not recognize vCenter Servers in a linked pool that are not included in the data collection configuration.
The image shows how VMware is installed across a Splunk platform deployment.
- See System requirements in the Splunk Enterprise Installation Manual.
- Plan your deployment according to the capacity planning guidelines in Splunk Enterprise capacity planning.
- If your deployment includes NetApp devices, install and configure Splunk App for NetApp Data ONTAP before you install Splunk App for VMware. See Prepare your Splunk App for NetApp.
- Mozilla Firefox
- Microsoft Internet Explorer 9 and above
- Apple Safari
- Google Chrome
The Splunk App for VMware does not support Internet Explorer 8 or Internet Explorer 9 Compatibility Mode.
Splunk App for VMware Installation Prerequisites
Installation of the Splunk App for VMware has the following prerequisites.
|Splunk platform||A configured and ready to use Splunk platform environment.|
|A search head that runs on a 64-bit Linux operating system.||Your Splunk environment can be a single-instance deployment, or a deployment with a dedicated search head and one or more indexers.|
|A Splunk platform license||A default Splunk platform configuration with a licensing volume that can support approximately 300MB of data per host per day.|
|Use of a supported version of VMware vCenter Server to manage hypervisors.||Splunk App for VMware integrates with a vCenter Server and the hypervisors it manages. Environments with Windows-based vCenter and/or Linux-based vCenter Server Appliance are supported. ESXi servers that are not managed through vCenter are not supported.|
|Installation and configuration of the Splunk Add-on for VMware||Installation of the Splunk Add-on for VMware is necessary to collect and transform data from VMWare vCenters, ESXi hosts and Virtual Machines. See Installation and Configuration of the Splunk Add-on for VMware for installation and configuration information.|
|Installation and configuration of the Splunk OVA for VMware||The Splunk OVA for VMware collects and harnesses Data Collection Node (DCN) data from the virtualization layer to enable functionality with Splunk IT Service Intelligence, the Splunk Add-on for VMware and the Splunk App for VMware. See Installation and Configuration of the Splunk OVA for VMware for DCN installation and configuration information.|
Component version compatibility
See the table to identify component version compatibility for your Splunk VMware deployment.
|Compatible Splunk platform version||Compatible Splunk App for VMWare version||Compatible vCenter version||Compatible vSphere version||Compatible ESXi version||Compatible SA-Hydra version||Compatible SA-Utils version|
|6.2.0 through 6.4.3||3.2.1 to 3.3.0||5.0 to 6.0||4.1, 5.0, 5.0 Update 1, 5.1, 5.5, 5.5a, 6.0||4.1, 5.0, 5.0 Update 1, 5.1, 5.5 on 64-bit x86 CPUs, 5.5 update 1 and above.||4.0.2 and above||3.5.0, 3.7.0|
|6.3 to 6.5||3.3.1||5.0 to 6.0||4.1, 5.0, 5.0 Update 1, 5.1, 5.5, 5.5a, 6.0||4.1, 5.0, 5.0 Update 1, 5.1, 5.5 on 64-bit x86 CPUs, 5.5 update 1 and above.||4.0.2 and above||3.5.0, 3.7.0|
|6.3 to 6.5||3.3.2||5.0 and above||4.1, 5.0, 5.0 Update 1, 5.1, 5.5, 5.5a, 6.0||4.1, 5.0, 5.0 Update 1, 5.1, 5.5 on 64-bit x86 CPUs, 5.5 update 1 and above.||4.0.2 and above||1.0.0 (Version 3.3.2 replaces |
Data volume requirements
In a typical environment, approximately 250 MB and 350 MB of data can be collected per host per day from your environment. This number varies depending on the volume of log data you collect, and the number of virtual machines that reside on a host. See the information below for further details.
|Collected data type||Data volume|
|Total vCenter logs||15 MB of data per host per day per vCenter. For example, 750MB in a 50 host environment.|
|ESXi host logs||185 MB of data per host per day. (In a typical environment this number can range from 135MB to 235M of data, but it can vary widely depending on your environment).|
|Total API data per host||10 MB of data per host per day.|
|Total API data per virtual machine||3 MB of data per day.|
The Splunk App for VMware uses the Splunk Add-on for VMware to install and manage distributed collection scheduling (previously contained in the Splunk App for VMware component bundle), and to deploy the python script
splunk_for_vmware_setup.py that collects DCN details, such as DCN URI, username, and password information from the Collection Configuration page, before sending them to
For single deployments of the VMware app scheduler, see the Splunk Enterprise search head hardware recommendations.
If you have Splunk App for NetApp ONTAP installed, it also uses the Collection Configuration page. See Prepare Splunk App for NetApp Data ONTAP of the Splunk App for NetApp Data ONTAP manual.
About the Splunk App for VMware
Plan your installation in a test environment
This documentation applies to the following versions of Splunk® App for VMware: 3.3.2