Splunk® App for VMware (Legacy)

Installation Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.

Configure Splunk App for VMware to collect data from vCenter Server

Configure a Data Collection Node

The Collection Configuration dashboard, on the search head, manages the Data Collection Nodes (DCNs). Register all data collection nodes with the Collection Configuration dashboard in order to collect data from vCenter Server. You must configure each DCN separately with the scheduler.

Register a DCN with the scheduler

  1. Log in to Splunk Web on the search head as admin.
  2. From the App menu, select VMware.
  3. From the Settings menu select Collection Configuration, and click +.
  4. Enter the settings for the data collection node, and click Save. See the Data Collection Node configuration settings table.
    Field Value
    Splunk Forwarder URI The address or port of the DCN. For example, https://<host_name_or_ip_address_of_DCN>:8089.
    Splunk Forwarder Username admin.
    Splunk Forwarder Password The administrator password. Make sure this password is not the Splunk Enterprise default admin password (changeme).
    Worker Processes Define the number of worker processes you want on the node. This is the number of processes you can run on the data collection node to process the data and forward it to the indexer(s). You can run a maximum of 30 processes per node at the default configuration. The number of worker processes must be one fewer than the number of CPU cores the vCenter Server system granted to the DCN. For example, if the DCN has four CPU cores, the number of worker processes is three.
  5. Confirm that you correctly configured the DCN by verifying that the DCN, credential validation, and add-on validation all display a green check.
  6. Repeat the steps for each DCN.

Configure vCenter Server

Add a vCenter Server system as a source of data in your environment.

  1. On the Collection Configuration dashboard, in the Virtual Centers panel, click +.
  2. Enter the settings for the vCenter Server.
    Field Value
    Virtual Center FQDN The fully-qualified domain name for the vCenter server. For example, test-vcenter100.example.com
    VC Username The user name that you configured in vCenter Server for Splunk Enterprise. Use the format username@domain if the user is an Active Directory account.
    VC Password The password that you configured in vCenter Server for Splunk Enterprise.
  3. For the initial installation, pull 20 or fewer hosts. If the vCenter Server manages other servers, make sure that Collect form all hosts and whitelist-specific hosts are not selected.
  4. Click Save.
  5. Verify that each of the vCenter Server entries displays a green check.
  6. Click Start Scheduler. The Distributed Collection Scheduler is running when the button label is Stop Scheduler.
  7. Test DCN and vCenter Server configurations

    1. Approximately ten minutes after you start the scheduler, access the search head and navigate to the Splunk Search field.
    2. Type a search string to test data collection. sourcetype=vmware:perf* OR sourcetype=vmware:inv:hierarchy
    3. Confirm that the search returns results. Dashboards and some of the other graphics might take up to 60 minutes to populate.
Last modified on 13 April, 2022
Configure the data collection node and system settings   Collect VMware vCenter Server Linux Appliance log data

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 4.0.4


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters