Deployment Architecture

Setup Splunk for VMware ESXi hosts

ahatom
New Member

I am trying to feed ESXi host syslogs to Splunk. The documentation around that is quite comprehensive. The requirement bits are quite daunting though. Just want to check if my understanding of the setup is correct.
1. My understanding is that I will need Splunk App for VMware to be installed on Indexer and SH for it to be able to interpret the VMware logs.
2. In addtion to the App, I will need Splunk Add-On for VMware to be installed on number of Splunk servers based on the document below?
https://docs.splunk.com/Documentation/VMW/3.4.5/Installation/Platformandhardwarerequirements
3. We use Splunk Cloud for search and indexing. So I assume the installation on SH and Indexer need to be carried out by Splunk?
4. From the document, it seems to indicate that I need a dedicated SH for VMware Add-on and App, is that correct?
5. The most confusing bit is DCN and Intermedia forwarder. Can they be on the same VM? The Splunk OVA for VMware, is that just for DCN? Do I have to use HF to forward esxilogs?

These are the fundamental questions I have for now.

0 Karma

ahatom
New Member
0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...