If you want to get the full collection of VMware metrics, and not just the logs - you will want to leverage the OVA image that Splunk provides to get you the required Linux based components. That is because the components that work to collect that info (Scheduler and Data Collection Node) only run on Linux. See: http://docs.splunk.com/Documentation/AddOns/released/VMW/Hardwareandsoftwarerequirements for more details If you just want the ESXi logs, then the full blown add-on may not be required, and you can probably just get away with the Splunk_TA_esxilogs , from the add-on. ... View more

In the latest release, they split the app into 3 separate components: Splunk App for VMware Splunk Add-On for VMware Splunk OVA for VMware The OVA is the optional virtual appliance that is the data collector. It is optional because you can build your own if you don't want to use the OVA. That, along with the add-on is required for complete setup of the data collection. The app is required for the front end visualization and pre-built dashboards. The app is the licensed component, where the add-on and OVA are free. ... View more

NetApp Data ONTAP is only supported on a Linux Search Head. http://docs.splunk.com/Documentation/NetApp/2.1.1/DeployNetapp/Platformandhardwarerequirements ... View more

Splunk App for VMware must run on Linux due to some Windows/Splunk related issues that don't happen on Linux/Splunk. Can't speak for the future product - since that would depend on the Windows/Splunk related issues being fixed first. ... View more

Have you first tried the built in event id filtering? You also might want to remove the Message key first just to make sure the filtering works by itself. Format would be: whitelist = 1025 So in your security logs example: [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 1 evt_resolve_ad_obj = 1 checkpointInterval = 5 whitelist = 1025 index = wineventlog_ivr renderXml=false Then if that works, you can add back the Message filter: [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 1 evt_resolve_ad_obj = 1 checkpointInterval = 5 whitelist = 1025 whitelist1 = Message="Object Type:\s+(?!groupPolicyContainer)" index = wineventlog_ivr renderXml=false ... View more

Might be overkill, but check out the Splunk App for Windows Infrastructure ( https://splunkbase.splunk.com/app/1680/ ) http://docs.splunk.com/Documentation/MSApp/1.1.3/Reference/ADAdministratorAudit http://docs.splunk.com/Documentation/MSApp/1.1.3/Reference/FailedLogons ... View more

I haven't tested this out - outside of splunk roles, but there is no capability for logon rights in splunk. In theory that should mean that anyone should be able to log on, however if no capabilities have been assigned to a splunk role - then they won't be able to do anything. ... View more

If you are the only user on the system and you are not using LDAP credentials to login, you could always reset the authentication. Here is a link to another post on how to do that: https://answers.splunk.com/answers/108654/cannot-login-already-tried-the-admin-changeme-thing.html ... View more

A Splunk instance running locally DOES NOT use the credentials set up on the splunk.com website. If it is a default setup, the default username is 'admin' and the password is 'changeme'. Exclude the single quotes though. ... View more

For the indexes.conf - maxTotalDataSizeMB is the TOTAL space that all of the indexed data will reside in (Hot+Warm+Cold). frozentimePeriodInSecs will determine when older data moves out of Hot+Warm+Cold. Whichever parameter reaches its limit first will detemine how the buckets are aged out. So to directly answer your question, the one that takes precedence depends on which parameter hits the limit first. Same holds true for tsidx_retention.conf parameters. ... View more

When you removed the DCN, did you wipe out the splunk directory that it was in and create a brand new directory for the UF? Also, did you restart the SH after you removed the DCN from the scheduler configuration? ... View more

I'm sure you checked this, but Is the VMware App scheduler still on? That would be the main thing that would continuously talk to the DCN machine. ... View more

Technically they do not have to go on the Indexer to make the app function. I have been told that SA-Utils and SA-Hydra are recommended only because they will stop modular input introspection from failing. ... View more

Syslog data doesn't have to go to the DCN's. The DCN's are only required for pulling the metrics from the vSphere API from the vCenter machine. You could set up the syslog data to be sent to a syslog server. Then put a Universal Forwarder on that server to send the data up to your indexers. ... View more

The ForwarderInfo lines are the heartbeats being sent. If you don't need them, you can disable the heartbeats by adding a heartbeatFrequency attribute and setting it to 0. See below: [tcpout] indexAndForward = true defaultGroup = nothing heartbeatFrequency = 0 ... View more