VMware and Splunk WITHOUT vCenter

[sammiller1210]

Hello,

We are currently setting up our ESXI server to work with Splunk. We know of the VMWare App but when reading everything I realized we may need vCenter as well. Is there anyway that you can use Splunk and VMWare without VCenter?

[bmacias84]

Do you not use vcenter? The answer is yes you can vmware has an sdk you can to pull data. Sdk comes in perl and powershell last I checked (Been a couple of years).

[abhide_splunk · Accepted solution]

You can use the current version you are using without needing vCenters. Unmanaged hosts are supported.

Please take a look at the documentation here, scroll down a little to the heading "Create stanzas to cover unmanaged ESX/i hosts in your environment"
http://docs.splunk.com/Documentation/VMW/latest/Install/Asimpleengine.conf#Configure_ESX.2Fi_host_da...

[abhide_splunk]

The folder that you need in the Splunk instance is downloadable. The folder you need is Splunk_TA_vmware, and it is part of the splunk_for_vmware-.zip file that you can get off splunkbase. Unzip that zip file somehwhere, the extracted version will contain the following folder structure etc/apps. In etc/apps you will find a bunch of Add-ons the one you need is Splunk_TA_vmware. This is the link on splunkbase for the zip file: http://splunk-base.splunk.com/apps/28423/splunk-app-for-vmware. you can copy Splunk_TA_vmware onto the splunk instance on Virtual apliance, it has the needed

[akuzma]

in 2.0.0 version of splunk forwarder virtual appliance for vmware there's no splunk_for_vmware_appliance folder so I cannot compile engine.conf file, is there any other way to compile it/use splunk on esxi without vcenter? Maybe you know where I can download older version of forwarder fo vmware?

[sammiller1210]

This seems to have worked so far! There is only one issue, the Virtual System Health and Host System Health both seem to be blank. I am not sure if this is a feature only available when interfacing with VCenter, though. Any ideas? Thank you so much for your help!