Splunk VMware TA Setup
Prerequisites
| Tool or access |
Purpose |
Verify |
| Bash and Python 3 |
Run bundled setup and validation helpers |
bash --version && python3 --version |
| Required product/platform access |
Inspect or configure the selected target |
Complete the documented preflight |
| Credential files for live modes |
Keep secrets out of chat |
Verify paths only |
Workflow Overview
┌───────────┐ ┌───────────────┐ ┌───────────────┐ ┌─────────────────┐
│ Preflight │ → │ Render/review │ → │ Apply/handoff │ → │ Validate evidence │
└───────────┘ └───────────────┘ └───────────────┘ └─────────────────┘
When to Activate
- VMware, vCenter, ESXi logs, VMware metrics, VMware indexes, VMware extractions, or making VMware data ready for
Splunk ITSI, Enterprise Security, Monitoring Console, or infrastructure dashboards.
- Preview and review the splunk vmware ta setup workflow before any live apply phase.
- Diagnose failed prerequisites, generated assets, configuration, or validation evidence.
Scope
Follow the documented read-only or render-first path whenever it is available.
This skill does not imply permission to mutate live systems. Require explicit
apply flags, protected credentials, and operator review for state changes.
Examples
Inspect the supported setup modes before selecting one:
bash skills/splunk-vmware-ta-setup/scripts/setup.sh --help
Expected output: usage, supported modes, and required arguments are displayed
without changing the target environment.
Inspect validation modes before running completion checks:
bash skills/splunk-vmware-ta-setup/scripts/validate.sh --help
Expected output: offline, live, and completion options are displayed when the
skill supports them; help exits without mutation.
Troubleshooting
| Issue |
Cause |
Resolution |
| Preflight fails |
A required tool or access path is missing |
Resolve it before rendering or applying |
| Rendered assets are incomplete |
Required non-secret inputs are absent |
Complete intake and render again |
| Apply is blocked |
Review, credentials, or explicit acceptance is missing |
Use the documented handoff |
| Validation is incomplete |
Live evidence is unavailable |
Record the gap and keep completion open |
TA Completion Gate
For every TA/add-on or dashboard companion run, satisfy the shared
TA completion gate: configure and enable the
data ingest path owned by this skill or its required companion, validate events
or metrics in the target indexes/source types, and verify any
pre-built/package-shipped dashboards are visible, macro-aligned, and returning
data. If the package ships no dashboards, record that evidence explicitly and
hand off dashboard use to the consuming app, ES/ITSI/ARI content, or readiness
doctor.
Render-first workflow for VMware data onboarding through Splunk Supported
Add-ons. VMware coverage spans multiple glossary entries: VMware, vCenter Logs,
ESXi Logs, VMware Extractions, VMware Indexes, VMware Metrics, and VMware
Metrics Indexes. Treat them as one deployment plan so index placement,
collection ownership, search-time knowledge, and ITSI readiness stay aligned.
Safety Rules
- Never ask for or pass vCenter passwords, appliance credentials, or Splunk
secrets in chat, argv, or environment-variable prefixes.
- Use local secret files for credentials, then configure accounts through the
owning add-on UI or REST handler.
- Do not deploy credential-bearing VMware collection apps broadly through
Deployment Server. Run each vCenter/DCN collection path on an explicit owner
to avoid duplicate inventory, task, event, and performance collection.
- Splunk Cloud search-tier package install is separate from customer-managed
data collection nodes, heavy forwarders, Universal Forwarders, and syslog
collectors.
Workflow
- Render the VMware package:
bash skills/splunk-vmware-ta-setup/scripts/setup.sh --render \
--event-index vmware \
--metrics-index vmware_metrics \
--esxi-index vmware_esxi \
--vcenter-account vc_prod
Review vmware-plan.md, indexes.conf.template,
vcenter-account-runbook.md, esxi-syslog-runbook.md, and
itsi-readiness.md.
Install VMware packages through splunk-app-install or a customer-approved
package source. If package files are available locally:
bash skills/splunk-vmware-ta-setup/scripts/setup.sh --install-package /path/to/package.spl
- Configure vCenter/DCN collection on one owner, configure ESXi syslog to the
selected syslog path, then run validation:
bash skills/splunk-vmware-ta-setup/scripts/validate.sh --rendered-dir splunk-vmware-ta-rendered
Use splunk-supported-addons-setup for glossary resolution and package
handoff, splunk-data-source-readiness-doctor after data lands, and
splunk-itsi-config for service/entity/KPI modeling.
1---2name: splunk-vmware-ta-setup3description: Use when the user asks about VMware, vCenter, ESXi logs, VMware metrics, VMware indexes, VMware extractions, or making VMware data ready for Splunk ITSI, Enterprise Security, Monitoring Console, or infrastructure dashboards. Install, render, configure, and validate Splunk Supported Add-on coverage for VMware, including the VMware app/add-on family, vCenter collection planning, ESXi syslog handoffs, event and metric index templates, deployment role placement, ITSI readiness, and post-ingest validation.4---56# Splunk VMware TA Setup78## Prerequisites910| Tool or access | Purpose | Verify |11|---|---|---|12| Bash and Python 3 | Run bundled setup and validation helpers | `bash --version && python3 --version` |13| Required product/platform access | Inspect or configure the selected target | Complete the documented preflight |14| Credential files for live modes | Keep secrets out of chat | Verify paths only |1516## Workflow Overview1718```text19┌───────────┐ ┌───────────────┐ ┌───────────────┐ ┌─────────────────┐20│ Preflight │ → │ Render/review │ → │ Apply/handoff │ → │ Validate evidence │21└───────────┘ └───────────────┘ └───────────────┘ └─────────────────┘22```2324## When to Activate2526- VMware, vCenter, ESXi logs, VMware metrics, VMware indexes, VMware extractions, or making VMware data ready for27 Splunk ITSI, Enterprise Security, Monitoring Console, or infrastructure dashboards.28- Preview and review the splunk vmware ta setup workflow before any live apply phase.29- Diagnose failed prerequisites, generated assets, configuration, or validation evidence.3031## Scope3233Follow the documented read-only or render-first path whenever it is available.34This skill does not imply permission to mutate live systems. Require explicit35apply flags, protected credentials, and operator review for state changes.3637## Examples3839Inspect the supported setup modes before selecting one:4041```bash42bash skills/splunk-vmware-ta-setup/scripts/setup.sh --help43```4445Expected output: usage, supported modes, and required arguments are displayed46without changing the target environment.4748Inspect validation modes before running completion checks:4950```bash51bash skills/splunk-vmware-ta-setup/scripts/validate.sh --help52```5354Expected output: offline, live, and completion options are displayed when the55skill supports them; help exits without mutation.5657## Troubleshooting5859| Issue | Cause | Resolution |60|---|---|---|61| Preflight fails | A required tool or access path is missing | Resolve it before rendering or applying |62| Rendered assets are incomplete | Required non-secret inputs are absent | Complete intake and render again |63| Apply is blocked | Review, credentials, or explicit acceptance is missing | Use the documented handoff |64| Validation is incomplete | Live evidence is unavailable | Record the gap and keep completion open |6566## TA Completion Gate6768For every TA/add-on or dashboard companion run, satisfy the shared69[TA completion gate](../shared/ta_completion_gate.md): configure and enable the70data ingest path owned by this skill or its required companion, validate events71or metrics in the target indexes/source types, and verify any72pre-built/package-shipped dashboards are visible, macro-aligned, and returning73data. If the package ships no dashboards, record that evidence explicitly and74hand off dashboard use to the consuming app, ES/ITSI/ARI content, or readiness75doctor.7677Render-first workflow for VMware data onboarding through Splunk Supported78Add-ons. VMware coverage spans multiple glossary entries: VMware, vCenter Logs,79ESXi Logs, VMware Extractions, VMware Indexes, VMware Metrics, and VMware80Metrics Indexes. Treat them as one deployment plan so index placement,81collection ownership, search-time knowledge, and ITSI readiness stay aligned.8283## Safety Rules8485- Never ask for or pass vCenter passwords, appliance credentials, or Splunk86 secrets in chat, argv, or environment-variable prefixes.87- Use local secret files for credentials, then configure accounts through the88 owning add-on UI or REST handler.89- Do not deploy credential-bearing VMware collection apps broadly through90 Deployment Server. Run each vCenter/DCN collection path on an explicit owner91 to avoid duplicate inventory, task, event, and performance collection.92- Splunk Cloud search-tier package install is separate from customer-managed93 data collection nodes, heavy forwarders, Universal Forwarders, and syslog94 collectors.9596## Workflow97981. Render the VMware package:99100```bash101bash skills/splunk-vmware-ta-setup/scripts/setup.sh --render \102 --event-index vmware \103 --metrics-index vmware_metrics \104 --esxi-index vmware_esxi \105 --vcenter-account vc_prod106```1071082. Review `vmware-plan.md`, `indexes.conf.template`,109 `vcenter-account-runbook.md`, `esxi-syslog-runbook.md`, and110 `itsi-readiness.md`.1111123. Install VMware packages through `splunk-app-install` or a customer-approved113 package source. If package files are available locally:114115```bash116bash skills/splunk-vmware-ta-setup/scripts/setup.sh --install-package /path/to/package.spl117```1181194. Configure vCenter/DCN collection on one owner, configure ESXi syslog to the120 selected syslog path, then run validation:121122```bash123bash skills/splunk-vmware-ta-setup/scripts/validate.sh --rendered-dir splunk-vmware-ta-rendered124```125126Use `splunk-supported-addons-setup` for glossary resolution and package127handoff, `splunk-data-source-readiness-doctor` after data lands, and128`splunk-itsi-config` for service/entity/KPI modeling.
chambear2809