Hi @token2 I disagree with some of the information in the markdown posted on the other post, specifically around the API usage (" Gathers performance data through the vCenter API") - This is not co...
See more...
Hi @token2 I disagree with some of the information in the markdown posted on the other post, specifically around the API usage (" Gathers performance data through the vCenter API") - This is not correct, neither of the apps mentioned connect to the API, the vCenter app uses syslog+monitor inputs (file monitoring) to pick up events, the ESXi app is purely syslog. The Splunk_TA_vcenter (Splunk Add-on for vCenter Log) should be installed on a Splunk Universal Forwarder running on the vCenter Server host, so it can monitor vCenter log files directly from the filesystem. This takes vCenter logs only, which last time I checked didnt seem to have the individual ESXi logs. The Splunk Add-on for VMware ESXi Logs should be installed on a Splunk forwarder or heavy forwarder that is receiving syslog data from the ESXi hosts, if you install this on the same host as the vCenter app then ensure you use a unique syslog port for this so the sourcetype field extractions can work correctly. If you want performance info/metrics etc then you need "Splunk Add-on for VMware Metrics": The Splunk Add-on for VMware Metrics is a collection of add-ons used to collect and transform the Performance, Inventory, Tasks, and Events data from VMware vCenters, ESXi hosts, and virtual machines. The Splunk Add-on for VMware Metrics contains the following components: Splunk_TA_vmware_inframon - Runs a Python-based API data collection engine, collects data from VMware vSphere environment, and performs field extractions for VMware data. SA-Hydra-inframon. Depending on your usecase you might prefer to use all, or a specific subset, of the many VMware apps available! Please let me know if you want further clarity on any of these and feel free to share your usecases so we can help refine which apps might benefit you. Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing