Deployment Architecture

Setup Splunk for VMware ESXi hosts

New Member

I am trying to feed ESXi host syslogs to Splunk. The documentation around that is quite comprehensive. The requirement bits are quite daunting though. Just want to check if my understanding of the setup is correct.
1. My understanding is that I will need Splunk App for VMware to be installed on Indexer and SH for it to be able to interpret the VMware logs.
2. In addtion to the App, I will need Splunk Add-On for VMware to be installed on number of Splunk servers based on the document below?
3. We use Splunk Cloud for search and indexing. So I assume the installation on SH and Indexer need to be carried out by Splunk?
4. From the document, it seems to indicate that I need a dedicated SH for VMware Add-on and App, is that correct?
5. The most confusing bit is DCN and Intermedia forwarder. Can they be on the same VM? The Splunk OVA for VMware, is that just for DCN? Do I have to use HF to forward esxilogs?

These are the fundamental questions I have for now.

0 Karma

New Member
0 Karma
Get Updates on the Splunk Community!

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...

Splunk Observability Cloud | Enhancing Your Onboarding Experience with the ...

We understand that your initial experience with getting data into Splunk Observability Cloud is crucial as it ...