topic Re: Need Help Installing/Configuring Splunk for VMWare App in All Apps and Add-ons

Need Help Installing/Configuring Splunk for VMWare App

maverick — Fri, 09 May 2014 01:59:52 GMT

I am having some trouble installing and configuring the new Splunk for VMWare App. It might just be me doing something stupid/not obvious. The docs are good, but perhaps too detailed to some extent. I'm following them along correctly, I think, but wondering if any of you who've been successful with getting it working can share your secret to success or point me to the right parts of the documentation or provide hints or tips/tricks that I can try. Anything would be greatly appreciated. Thanks.

Re: Need Help Installing/Configuring Splunk for VMWare App

cladd_splunk — Fri, 09 May 2014 02:07:59 GMT

What kind of issue are you seeing?

Re: Need Help Installing/Configuring Splunk for VMWare App

bbingham — Fri, 09 May 2014 02:32:55 GMT

Here's imo the TL;DR response to our docs:

Install the DCN, make sure the firewall is off and either allow remote auth or change the default password.
Install the main app
Add the dcn's IP and login creds to the VC ( I'd even recommend not turning on syslog till you know you're collecting data)
Add the "splunk_vmware_admin" role to your main user
Hit start scheduler

Hopefully that gets you data, most often people forget the role, or they have user perm issue with the VC. If you're not getting any data in and the checkmarks are all "green" on the config page, you'll probably find a detailed reason in the hydra logs.

Re: Need Help Installing/Configuring Splunk for VMWare App

rgantly_splunk — Mon, 28 Sep 2020 16:34:13 GMT

Some troubleshooting information, to help you pinpoint your issues:

Check your Splunk Version. Check that it is the correct version for this app: See http://docs.splunk.com/Documentation/VMW/latest/Install/SystemRequirements
Assign the vmware_admin role to the user "admin" or, add this role to admin role, See http://docs.splunk.com/Documentation/VMW/latest/Install/Installonyoursearchheadorindexer and more Info. here: http://docs.splunk.com/Documentation/VMW/latest/User/Userroles
Check that Firewall ports 8008/8089 (splunkd) are open. See http://docs.splunk.com/Documentation/VMW/latest/Install/Planyourdeployment and http://docs.splunk.com/Documentation/VMW/latest/Install/InstallationChecklist
Check the permissions of the account Splunk is using on vCenter. See http://docs.splunk.com/Documentation/VMW/latest/Install/OnvCenter
Install missing WSDL files ( for vSphere 5.0 ). See http://docs.splunk.com/Documentation/VMW/latest/Install/SetupRequirements#On_vCenter:
Enable forwarding _internal from DCNs (for App Health view and troubleshooting). See http://docs.splunk.com/Documentation/VMW/latest/Install/Getacollectionnode#Turn_on_troubleshooting_logs
Change the default admin password ( for remote access to UF on vCenter). See http://docs.splunk.com/Documentation/VMW/latest/Install/Getacollectionnode
Check that the number of workers does not exceed the total number of CPU cores in the DCNs. (The number of workers should quell the number of CPU cores minus one - for system resource usage concerns.)
Start the "Scheduler" using the GUI configuration page. See http://docs.splunk.com/Documentation/VMW/latest/Install/Collectdatafromyourenvironment#Start_the_Distributed_Collection_Scheduler
Check that all system clocks among servers are synchronized. Secheduled searches can fail to return the correct results. Sometimes this issue can cause no results to be returned. See http://docs.splunk.com/Documentation/VMW/latest/Install/ConfigureOperatingSystemproperties#Change_the_NTP_server_pool_list
For compatibility with the Splunk App for NetApp Data ONTAP, See http://docs.splunk.com/Documentation/VMW/latest/Install/RequirementsfortheSplunkAppforNetAppDataONTAP
Wait for four hours to get data if you just deployed your configurations as scheduled searches need to populate all data. See http://docs.splunk.com/Documentation/VMW/latest/Install/Isdatacomingin#The_App_Install_Health_Dashboard

Re: Need Help Installing/Configuring Splunk for VMWare App

abhide_splunk — Fri, 09 May 2014 20:23:01 GMT

You can also take a look at the Installation Video Guide.

https://www.youtube.com/watch?v=GgJUkh0eFH4

Feedback welcome.