How can I use the Splunk App for VMWare and The Splunk Add-on for VMware?

[tpreusche]

Hi - I'm new in Splunk and I need some help.. We've installed Splunk 6.4.3 on a linux-based VM and now we like analyze VMware data. That's the reason we have installed Splunk App for VMware 3.3.0 and Splunk Add-on for VMware 3.3.0 on the graphical interface from Splunk. But nothing has changed except the folder "SA-Threshold" and "SA-Hydra" in "Splunk Apps".
What should I have to do now? How can I use both applications? Thanks in advance...

[tpreusche]

hello,

I've tried several times to follow the manual (http://docs.splunk.com/Documentation/VMW/3.3.0/Installation/InstalltheSplunkAppforVMwareinadistribut...).
The installation of the packages is easy, but after STEP 3 I am unable to log into SPLUNK again.

I have skipped step 4 ((Optional) Remove the SA-VMW-Licensecheck folder from the $SPLUNK_HOME\etc\apps folder if it exists. )

When I try to log into SPLUNK I get an error message.
I've tried to login from the splunk server itself and also from remote.
No other changes have been made to the configuration. I have restarted SPLUNK, rebooted the VM etc.

If I move the following folder out of "/opt/splunk/etc/apps" SPLUNK is working again:

SA-Hydra
SA-Utils
SA-VMW-LogEventTask
splunk_for_vmware
Splunk_TA_vcenter
SA-Threshold
SA-VMW-HierarchyInventory
SA-VMW-Performance

Splunk_TA_esxilogs
Splunk_TA_vmware

Any ideas where to look for the error? Which log file can help me to discover the error?

• Tina

[tpreusche]

Thanks for your answers.

I have watched the video and I know the link, too but that didn't helped me. In the installation guide I've found no instructions to install Splunk on the graphical interface but only in the VM. Maybe I have overlook something?

I lost setting up the connection between the Splunk-server (single instance) and the vcenter.
As I evaluating Splunk from an operator perspective it seems I'm missing out necessary intermediate configuration steps to establish the connection Splunk to VMware vCenter.

We want to use Splunk to monitor our vSphere test lab to research performance issues when running virtual desktops (VMware Horizon View).

[sduchene_splunk]

Splunk Single instance ? not possible. you need this architecture: http://docs.splunk.com/Documentation/AddOns/released/VMW/Installationoverview

[tpreusche]

Thanks, then I'll try it again and do exactly, what the guide recommend. Should I deactivate the App/Add-on on Splunk before I can try it again? (It isn't possible to uninstall the applications.)

[somesoni2]

Here is the full documentation on the Splunk App for VMWare, providing instructions for installation, configuration and use of it

http://docs.splunk.com/Documentation/VMW

[sduchene_splunk]

Have you followed the addon docs specified in the "details" part of splunkbase ? :
http://docs.splunk.com/Documentation/AddOns/released/VMW/About
and also the doc from vmware app :
http://docs.splunk.com/Documentation/VMW

I also recommend you watch this video : youtube

Unlike other apps, this app requires a good understanding of Splunk, so i'd recommend :
1/you have time to learn: read all this, take a class.
2/you don't have time : onboard an expert, he will set this up for you quickly.