Deployment Architecture

Setup Splunk for VMware ESXi hosts

New Member

I am trying to feed ESXi host syslogs to Splunk. The documentation around that is quite comprehensive. The requirement bits are quite daunting though. Just want to check if my understanding of the setup is correct.
1. My understanding is that I will need Splunk App for VMware to be installed on Indexer and SH for it to be able to interpret the VMware logs.
2. In addtion to the App, I will need Splunk Add-On for VMware to be installed on number of Splunk servers based on the document below?
3. We use Splunk Cloud for search and indexing. So I assume the installation on SH and Indexer need to be carried out by Splunk?
4. From the document, it seems to indicate that I need a dedicated SH for VMware Add-on and App, is that correct?
5. The most confusing bit is DCN and Intermedia forwarder. Can they be on the same VM? The Splunk OVA for VMware, is that just for DCN? Do I have to use HF to forward esxilogs?

These are the fundamental questions I have for now.

0 Karma

New Member
0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...