Deployment Architecture

Setup Splunk for VMware ESXi hosts

New Member

I am trying to feed ESXi host syslogs to Splunk. The documentation around that is quite comprehensive. The requirement bits are quite daunting though. Just want to check if my understanding of the setup is correct.
1. My understanding is that I will need Splunk App for VMware to be installed on Indexer and SH for it to be able to interpret the VMware logs.
2. In addtion to the App, I will need Splunk Add-On for VMware to be installed on number of Splunk servers based on the document below?
3. We use Splunk Cloud for search and indexing. So I assume the installation on SH and Indexer need to be carried out by Splunk?
4. From the document, it seems to indicate that I need a dedicated SH for VMware Add-on and App, is that correct?
5. The most confusing bit is DCN and Intermedia forwarder. Can they be on the same VM? The Splunk OVA for VMware, is that just for DCN? Do I have to use HF to forward esxilogs?

These are the fundamental questions I have for now.

0 Karma

New Member
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...