Hello,
We are currently setting up our ESXI server to work with Splunk. We know of the VMWare App but when reading everything I realized we may need vCenter as well. Is there anyway that you can use Splunk and VMWare without VCenter?
You can use the current version you are using without needing vCenters. Unmanaged hosts are supported.
Please take a look at the documentation here, scroll down a little to the heading "Create stanzas to cover unmanaged ESX/i hosts in your environment"
http://docs.splunk.com/Documentation/VMW/latest/Install/Asimpleengine.conf#Configure_ESX.2Fi_host_da...
Do you not use vcenter? The answer is yes you can vmware has an sdk you can to pull data. Sdk comes in perl and powershell last I checked (Been a couple of years).
You can use the current version you are using without needing vCenters. Unmanaged hosts are supported.
Please take a look at the documentation here, scroll down a little to the heading "Create stanzas to cover unmanaged ESX/i hosts in your environment"
http://docs.splunk.com/Documentation/VMW/latest/Install/Asimpleengine.conf#Configure_ESX.2Fi_host_da...
The folder that you need in the Splunk instance is downloadable. The folder you need is Splunk_TA_vmware, and it is part of the splunk_for_vmware-
in 2.0.0 version of splunk forwarder virtual appliance for vmware there's no splunk_for_vmware_appliance folder so I cannot compile engine.conf file, is there any other way to compile it/use splunk on esxi without vcenter? Maybe you know where I can download older version of forwarder fo vmware?
This seems to have worked so far! There is only one issue, the Virtual System Health and Host System Health both seem to be blank. I am not sure if this is a feature only available when interfacing with VCenter, though. Any ideas? Thank you so much for your help!