Splunk Add-on for VMWare app- What is the Data Collection Node and Scheduler?

[Lwoods]

Hello,

I have a distributed environment:  1 Search Head (SH), 1 Indexer, 1 Deployment Server, and 1 Syslog Server. I deployed my apps to the Syslog server for those devices that cannot have a forwarder installed. In Splunk Add-on for VMware, it shows a diagram of a distributed environment.  I have my VMware device logs sent to the syslog server, then the syslog server sends them to the indexer. I've installed the add-ons for VMware Esxi Logs on SH and Syslog, and VMware add-on for Indexes on the Indexer.

I don't understand what a Data Collection Node, or a Data Collection Scheduler is?  The documentation is confusing.   What are these and do I need them in my environment for my VMware devices?

Thanks

[isoutamo · Accepted solution]

Hi

it’s long time ago when I last use this, so I probably don’t remember all details:-(

Those are separate components which are used to manipulate/ fetch logs from vcenter. You need one scheduler and at least one DCN maybe more if you have big VMware environment. If I recall right there were separate OVAs which you could use? 
r. Ismo