topic Re: Adding ESX hosts to an existing Splunk server in Getting Data In

Adding ESX hosts to an existing Splunk server

mikeyw — Wed, 10 Oct 2012 09:30:30 GMT

Hi,

I've inherited a splunk server that was setup to receive to vmkwarning files from around 20 ESX hosts.

Recently i built another 5 hosts running ESX5 that i'd like to also get the vmkwarning files sent to the splunk server, what's the best guide to show me how to do this ?

I presume some kind of splunk forwarding agent has to reside on the ESX host ?

Thanks

Re: Adding ESX hosts to an existing Splunk server

sdaniels — Wed, 10 Oct 2012 12:20:03 GMT

Yes, you'll need to install a splunk forwarder on the ESX host. Then you'll set up file monitoring. Take a look at one of your existing ESX server forwarders. You should find settings in /etc/system/local/ in outputs.conf and inputs.conf. Outputs will have the settings for communicating back to the Splunk server and inputs.conf has the details of the file being monitored. In this case probably /var/log/vmkwarning.log.

http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Deploymentoverview

http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitorfilesanddirectories

Re: Adding ESX hosts to an existing Splunk server

mikeyw — Wed, 10 Oct 2012 14:57:59 GMT

I've just checked on a couple of ESX hosts that the splunk server is collecting log information from and did a global find for both outputs.conf and inputs.conf, nothing was returned. What is the default location for the splunk forwarders on a ESX node ?

Re: Adding ESX hosts to an existing Splunk server

mikeyw — Thu, 11 Oct 2012 08:53:33 GMT

Any further thoughts here guys ?