topic VMware and Splunk WITHOUT vCenter in All Apps and Add-ons

VMware and Splunk WITHOUT vCenter

sammiller1210 — Wed, 29 May 2013 18:17:37 GMT

Hello,

We are currently setting up our ESXI server to work with Splunk. We know of the VMWare App but when reading everything I realized we may need vCenter as well. Is there anyway that you can use Splunk and VMWare without VCenter?

Re: VMware and Splunk WITHOUT vCenter

abhide_splunk — Wed, 29 May 2013 18:48:02 GMT

You can use the current version you are using without needing vCenters. Unmanaged hosts are supported.

Please take a look at the documentation here, scroll down a little to the heading "Create stanzas to cover unmanaged ESX/i hosts in your environment"
http://docs.splunk.com/Documentation/VMW/latest/Install/Asimpleengine.conf#Configure_ESX.2Fi_host_data_inputs

Re: VMware and Splunk WITHOUT vCenter

bmacias84 — Wed, 29 May 2013 19:22:04 GMT

Do you not use vcenter? The answer is yes you can vmware has an sdk you can to pull data. Sdk comes in perl and powershell last I checked (Been a couple of years).

Re: VMware and Splunk WITHOUT vCenter

sammiller1210 — Tue, 04 Jun 2013 15:33:15 GMT

This seems to have worked so far! There is only one issue, the Virtual System Health and Host System Health both seem to be blank. I am not sure if this is a feature only available when interfacing with VCenter, though. Any ideas? Thank you so much for your help!

Re: VMware and Splunk WITHOUT vCenter

akuzma — Mon, 28 Sep 2020 14:13:10 GMT

in 2.0.0 version of splunk forwarder virtual appliance for vmware there's no splunk_for_vmware_appliance folder so I cannot compile engine.conf file, is there any other way to compile it/use splunk on esxi without vcenter? Maybe you know where I can download older version of forwarder fo vmware?

Re: VMware and Splunk WITHOUT vCenter

abhide_splunk — Mon, 28 Sep 2020 14:14:20 GMT

The folder that you need in the Splunk instance is downloadable. The folder you need is Splunk_TA_vmware, and it is part of the splunk_for_vmware-.zip file that you can get off splunkbase. Unzip that zip file somehwhere, the extracted version will contain the following folder structure etc/apps. In etc/apps you will find a bunch of Add-ons the one you need is Splunk_TA_vmware. This is the link on splunkbase for the zip file: http://splunk-base.splunk.com/apps/28423/splunk-app-for-vmware. you can copy Splunk_TA_vmware onto the splunk instance on Virtual apliance, it has the needed