Splunk with VMware's SDR how does the forwarder work?

[dcroteau]

Splunk with VMware's SDR how does the forwarder work?

[bensontan]

After Splunk for VMware beta, it no longer use vMA.

[dcroteau]

My apologies, to clearify: Splunk/vMA: How does it work with VMware's SDR.

[gkanapathy]

Question is extremely unclear.

[dcroteau]

Splunk collect all the logs associated with hosts as DRS does its job and we collect metrics per host and per VM per normal. The vMA doesn’t move around due to DRS.