Splunk App for VMware: Is there any way I can retrieve IP addresses of my VMs from the app?

[nilaysh]

I have a configured VMware app with 1 DCN. As I look into the data being indexed into Splunk, there are details of Virtual Machines with the VM Name.
I want to know how can I map the VM Name to its IP Address/Hostname for further clarity. The IP addresses are only available for the Hosts but not the VMs.

Any help in how I can achieve this or what I am missing? Thank you in advance

[bparekh_splunk · Accepted solution]

If VMware Tool is installed on VMs then you will get the ip in changeSet.guest.ipAddress field and hostname in changeSet.guest.ipStack{}.dnsConfig.domainName.

[nilaysh]

Thank you. I noticed some VMs did not have VMware tools and some did. I also enabled worker processes on the forwarder where the DCN is configured.