Need Help Installing/Configuring Splunk for VMWare App

[maverick]

I am having some trouble installing and configuring the new Splunk for VMWare App. It might just be me doing something stupid/not obvious. The docs are good, but perhaps too detailed to some extent. I'm following them along correctly, I think, but wondering if any of you who've been successful with getting it working can share your secret to success or point me to the right parts of the documentation or provide hints or tips/tricks that I can try. Anything would be greatly appreciated. Thanks.

[abhide_splunk]

You can also take a look at the Installation Video Guide.

https://www.youtube.com/watch?v=GgJUkh0eFH4

Feedback welcome.

[rgantly_splunk]

Some troubleshooting information, to help you pinpoint your issues:

• Check your Splunk Version. Check that it is the correct version for this app: See http://docs.splunk.com/Documentation/VMW/latest/Install/SystemRequirements
• Assign the vmware_admin role to the user "admin" or, add this role to admin role, See http://docs.splunk.com/Documentation/VMW/latest/Install/Installonyoursearchheadorindexer and more Info. here: http://docs.splunk.com/Documentation/VMW/latest/User/Userroles
• Check that Firewall ports 8008/8089 (splunkd) are open. See http://docs.splunk.com/Documentation/VMW/latest/Install/Planyourdeployment and http://docs.splunk.com/Documentation/VMW/latest/Install/InstallationChecklist
• Check the permissions of the account Splunk is using on vCenter. See http://docs.splunk.com/Documentation/VMW/latest/Install/OnvCenter
• Install missing WSDL files ( for vSphere 5.0 ). See http://docs.splunk.com/Documentation/VMW/latest/Install/SetupRequirements#On_vCenter:
• Enable forwarding _internal from DCNs (for App Health view and troubleshooting). See http://docs.splunk.com/Documentation/VMW/latest/Install/Getacollectionnode#Turn_on_troubleshooting_l...
• Change the default admin password ( for remote access to UF on vCenter). See http://docs.splunk.com/Documentation/VMW/latest/Install/Getacollectionnode
• Check that the number of workers does not exceed the total number of CPU cores in the DCNs. (The number of workers should quell the number of CPU cores minus one - for system resource usage concerns.)
• Start the "Scheduler" using the GUI configuration page. See http://docs.splunk.com/Documentation/VMW/latest/Install/Collectdatafromyourenvironment#Start_the_Dis...
• Check that all system clocks among servers are synchronized. Secheduled searches can fail to return the correct results. Sometimes this issue can cause no results to be returned. See http://docs.splunk.com/Documentation/VMW/latest/Install/ConfigureOperatingSystemproperties#Change_th...
• For compatibility with the Splunk App for NetApp Data ONTAP, See http://docs.splunk.com/Documentation/VMW/latest/Install/RequirementsfortheSplunkAppforNetAppDataONTA...
• Wait for four hours to get data if you just deployed your configurations as scheduled searches need to populate all data. See http://docs.splunk.com/Documentation/VMW/latest/Install/Isdatacomingin#The_App_Install_Health_Dashbo...

[bbingham]

Here's imo the TL;DR response to our docs:

1. Install the DCN, make sure the firewall is off and either allow remote auth or change the default password.
2. Install the main app
3. Add the dcn's IP and login creds to the VC ( I'd even recommend not turning on syslog till you know you're collecting data)
4. Add the "splunk_vmware_admin" role to your main user
5. Hit start scheduler

Hopefully that gets you data, most often people forget the role, or they have user perm issue with the VC. If you're not getting any data in and the checkmarks are all "green" on the config page, you'll probably find a detailed reason in the hydra logs.

[cladd_splunk]

What kind of issue are you seeing?