I am trying to feed ESXi host syslogs to Splunk. The documentation around that is quite comprehensive. The requirement bits are quite daunting though. Just want to check if my understanding of the setup is correct.
1. My understanding is that I will need Splunk App for VMware to be installed on Indexer and SH for it to be able to interpret the VMware logs.
2. In addtion to the App, I will need Splunk Add-On for VMware to be installed on number of Splunk servers based on the document below?
https://docs.splunk.com/Documentation/VMW/3.4.5/Installation/Platformandhardwarerequirements
3. We use Splunk Cloud for search and indexing. So I assume the installation on SH and Indexer need to be carried out by Splunk?
4. From the document, it seems to indicate that I need a dedicated SH for VMware Add-on and App, is that correct?
5. The most confusing bit is DCN and Intermedia forwarder. Can they be on the same VM? The Splunk OVA for VMware, is that just for DCN? Do I have to use HF to forward esxilogs?
These are the fundamental questions I have for now.
