Migrate from the Splunk Supporting Add-on for VMware or the Splunk App for VMware to the Content Pack for VMware Dashboards and Reports

Note: On January 11, 2023, the Splunk Supporting Add-on for VMware will reach its end of life and Splunk will no longer maintain or develop this product.

The Content Pack for VMware Dashboards and Reports replicates the dashboards and reports available in the Splunk Supporting Add-on for VMware and the Splunk App for VMware. Migrate from these legacy apps to the content pack to take advantage of a consolidated experience within one app, either ITSI or IT Essentials Work. In addition, you can upgrade all content packs by upgrading the one app, the Splunk App for Content Packs.

Note: On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to the Content Pack for VMware Dashboards and Reports.

If you are currently using Splunk Supporting Add-on for VMware your deployment might look like the following image and table:

"Diagram of pre-migration deployment. Review the table that follows for more info."
Component Search head Scheduler Indexer Data Collection Node (DCN) ESXi log forwarder vCenter log forwarder
Splunk App for VMware ✓          
Splunk Add-on for VMware   ✓ ✓ ✓    
Splunk Add-on for ESXi Logs ✓   ✓   ✓  
Splunk Add-on for vCenter Logs ✓   ✓     ✓
Splunk Add-on for VMware Indexes     ✓      
Splunk Add-on for VMware Extractions ✓          

You can review the dashboards included in the Content Pack for VMware Dashboards before you migrate. See Dashboard reference for the Content Pack for VMware Dashboards and Reports.

Migration steps for Cloud environments

Splunk App for VMware consumes data produced from Splunk Add-on for VMware. The Content Pack for VMware Dashboards and Reports consumes data produced from Splunk Add-on for VMware Metrics.

Before you submit a request for migration

Before you submit a request to migrate from Splunk App for VMware to Content Pack for VMware Dashboards and Reports, make sure that you have configured Splunk Add-on for VMware Metrics to forward data in your Splunk Cloud environment. See Installation and Configuration Overview of Splunk Add-on for VMware Metrics to install and configure Splunk Add-on for VMware Metrics in your environment.

After Splunk Add-on for VMware Metrics is configured to ingest the data in Splunk Cloud environment, to start migrating from Splunk App for VMware to Content Pack for VMware Dashboards and Reports on Cloud, open a service ticket on the Splunk Support Portal, in the Support and Services section. Splunk Cloud TechOps will assist you with migration from Splunk App for VMware to Content Pack for VMware Dashboards and Reports.

Migration steps for On-Premises environments

Splunk App for VMware consumes the data collected by Splunk Add-on for VMware, while Content Pack for VMware Dashboards and Reports consumes the data collected by Splunk Add-on for VMware Metrics.

Update the VMware data collection mechanism

If you plan to use Content Pack for VMware Dashboards and Reports Content Pack in your environment, then configure Splunk Add-on for VMware Metrics to collect the VMware data in that environment. For steps to install and configure Splunk Add-on for VMware Metrics, see Installation and Configuration Overview of Splunk Add-on for VMware Metrics.

Note: Splunk Add-on for VMware and Splunk Add-on for VMware Metrics can not co-exist on same Scheduler/DCN components. Make sure to disable one or the other if you are planning to install both add-ons on the same machines. Failure to first one or the other can cause conflicts between knowledge objects.

Before you migrate

Before migrating to Content Pack for VMware Dashboards and Reports, make sure to follow the steps below to make a backup of your custom configurations and lookups.

  1. Make a backup of the following directories present in the splunk_for_vmware package present in $SPLUNK_HOME/etc/apps on the search head where the App is being used:
    1. /local directory that contains all the local configurations under conf files
    2. /lookups directory that contains the CSV lookups
  2. Make a backup of the configuration files from the local folder of the SA-VMW-HierarchyInventory package on the search head where App is being used:
    1. datamodels.conf
  3. Make a backup of the lookups from the SA-VMW-HierarchyInventor/lookups package in $SPLUNK_HOME/etc/apps on the search head where the App is being used:
    1. DatastoreList.csv
    2. FullHierarchy.csv
    3. TimeAboutHost.csv
    4. TimeClusterServicesAvailability.csv
    5. TimeDatastoreSummary.csv
    6. TimeInvHostHardwareAndLicense.csv
    7. UniqueNameLookup.csv
  4. Make a backup of the lookups from the SA-VMW-Performance package on the search head where the App is being used:
    1. ACFields.csv
    2. HSFieldList.csv
    3. HSInstanceList.csv
  5. Make a backup of the lookups from the SA-VMW-LogEventTask package on the search head where the App is being used:
    1. vmware_event_lookup.csv
    2. vmware_task_lookup.csv
  6. Perform the following steps on each role present in the instance:
    1. Navigate to Settings > Roles
    2. Click on Edit > Edit
    3. Deselect the splunk_vmware_admin role from the Inheritance tab if shows as selected.
    4. Click on Save.
  7. Perform the following steps on user inheriting the splunk_vmware_user role:
    1. Navigate to Settings > Users.
    2. Click on Edit > Edit.
    3. Navigate to Assign Roles.
    4. From Selected item(s) > Remove splunk_vmware_user role.
    5. Click on Save.

Steps to migrate from Splunk App for VMware to Content Pack for VMware Dashboards and Reports

Follow the procedure below to migrate from Splunk App for VMware to Content Pack for VMware Dashboards and Reports. Make sure you've backed up existing lookups and custom configurations before you start following the steps below.

  1. Perform the steps below on each Search Head present in your deployment to disable the Splunk App for VMware:
    2. [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) Navigate to [/topic/topic/body/section/ol/ol/li/codeph {""}) {SPLUNK_HOME}/etc/apps/splunk_for_vmware/local/app.conf (codeph] (create app.conf file in local directory if it is not present) (li] [/topic/topic/body/section/ol/ol/li {""}) Edit the "state" property of the "install" stanza as shown below: (li] (ol] [/topic/topic/body/section/ol/codeblock {""}) [install] state = disabled (codeblock] [/topic/topic/body/section/ol/li {""}) Perform the steps below on each Search Head present in your deployment to disable the Splunk App for VMware Performance: (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) Navigate to [/topic/topic/body/section/ol/ol/li/codeph {""}) {SPLUNK_HOME}/etc/apps/SA-VMW-Performance/local/app.conf (codeph] (create app.conf file in local directory if it is not present) (li] [/topic/topic/body/section/ol/ol/li {""}) Edit the "state" property of the "install" stanza as shown below: (li] (ol] [/topic/topic/body/section/ol/codeblock {""}) [install] state = disabled (codeblock] [/topic/topic/body/section/ol/li {""}) Perform the steps below on each Search Head present in your deployment to disable the Splunk App for Threshold: (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) Navigate to [/topic/topic/body/section/ol/ol/li/codeph {""}) {SPLUNK_HOME}/etc/apps/SA-Threshold/local/app.conf (codeph] (create app.conf file in local directory if it is not present) (li] [/topic/topic/body/section/ol/ol/li {""}) Edit the "state" property of the "install" stanza as shown below: (li] (ol] [/topic/topic/body/section/ol/codeblock {""}) [install] state = disabled (codeblock] [/topic/topic/body/section/ol/li {""}) Perform the steps below on each Search Head present in your deployment to disable the Splunk App for VMware Log Event Task: (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) Navigate to [/topic/topic/body/section/ol/ol/li/codeph {""}) {SPLUNK_HOME}/etc/apps/SA-VMW-LogEventTask/local/app.conf (codeph] (create app.conf file in local directory if it is not present) (li] [/topic/topic/body/section/ol/ol/li {""}) Edit the "state" property of the "install" stanza as shown below: (li] (ol] [/topic/topic/body/section/ol/codeblock {""}) [install] state = disabled (codeblock] [/topic/topic/body/section/ol/li {""}) Perform the steps below on each Search Head present in your deployment to disable the Splunk App for VMware NetApp Utils: (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) Navigate to [/topic/topic/body/section/ol/ol/li/codeph {""}) {SPLUNK_HOME}/etc/apps/SA-VMNetAppUtils/local/app.conf (codeph] (create app.conf file in local directory if it is not present) (li] [/topic/topic/body/section/ol/ol/li {""}) Edit the "state" property of the "install" stanza as shown below: (li] (ol] [/topic/topic/body/section/ol/codeblock {""}) [install] state = disabled (codeblock] [/topic/topic/body/section/ol/li {""}) Perform the steps below on each Search Head present in your deployment to disable the Splunk App for VMware Hierarchy Inventory: (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) Navigate to [/topic/topic/body/section/ol/ol/li/codeph {""}) {SPLUNK_HOME}/etc/apps/SA-VMW-HierarchyInventory/local/app.conf (codeph] (create app.conf file in local directory if it is not present) (li] [/topic/topic/body/section/ol/ol/li {""}) Edit the "state" property of the "install" stanza as shown below: (li] (ol] [/topic/topic/body/section/ol/codeblock {""}) [install] state = disabled (codeblock] [/topic/topic/body/section/ol/li {""}) Perform the steps below on each Search Head present in your deployment to disable the Splunk Add-on for VMware Extractions: (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) Navigate to [/topic/topic/body/section/ol/ol/li/codeph {""}) {SPLUNK_HOME}/etc/apps/TA-VMW-FieldExtractions/local/app.conf (codeph] (create app.conf file in local directory if it is not present) (li] [/topic/topic/body/section/ol/ol/li {""}) Edit the "state" property of the "install" stanza as shown below: (li] (ol] [/topic/topic/body/section/ol/codeblock {""}) [install] state = disabled (codeblock] [/topic/topic/body/section/ol/li {""}) Perform the steps below on each Search Head present in your deployment to disable the Splunk Add-on for VMware: (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) Navigate to [/topic/topic/body/section/ol/ol/li/codeph {""}) {SPLUNK_HOME}/etc/apps/Splunk_TA_vmware/local/app.conf (codeph] (create app.conf file in local directory if it is not present) (li] [/topic/topic/body/section/ol/ol/li {""}) Edit the "state" property of the "install" stanza as shown below: (li] (ol] [/topic/topic/body/section/ol/codeblock {""}) [install] state = disabled (codeblock] [/topic/topic/body/section/ol/li {""}) Perform the steps below on each Search Head present in your deployment to disable the Splunk App for Hydra: (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) Navigate to [/topic/topic/body/section/ol/ol/li/codeph {""}) {SPLUNK_HOME}/etc/apps/SA-Hydra/local/app.conf (codeph] (create app.conf file in local directory if it is not present) (li] [/topic/topic/body/section/ol/ol/li {""}) Edit the "state" property of the "install" stanza as shown below: (li] (ol] [/topic/topic/body/section/ol/codeblock {""}) [install] state = disabled (codeblock] [/topic/topic/body/section/ol/li {""}) Restart the all the Search Heads and Indexers present in your deployment. (li] [/topic/topic/body/section/ol/codeblock {""}) $SPLUNK_HOME/bin/splunk restart (codeblock] [/topic/topic/body/section/ol/li {""}) Install IT Service Intelligence or IT Essentials Work on the same search head with VMware data according to your type of deployment. Refer to these topics in the Splunk IT Service Intelligence Install and Upgrade Manual: (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/xref {"unresolved-reference"}) ERROR - unresolved reference (ITSI_4.20.0_Install_Install) (xref]. (li] [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/xref {"unresolved-reference"}) ERROR - unresolved reference (ITSI_4.20.0_Install_InstallDD) (xref]. (li] [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/xref {"unresolved-reference"}) ERROR - unresolved reference (ITEWork_4.20.0_Install_Install) (xref]. (li] (ol] [/topic/topic/body/section/ol/li {""}) Install the Splunk App for Content Packs according to your type of deployment: (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/xref {"unresolved-reference"}) ERROR - unresolved reference (ContentPackApp_2.3.0_Overview_Install__Install_the_Splunk_App_for_Content_Packs_on_a_single.2C_on-premises_environment) (xref]. (li] [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/xref {"unresolved-reference"}) ERROR - unresolved reference (ContentPackApp_2.3.0_Overview_Install__Install_the_Splunk_App_for_Content_Packs_on_a_distributed_environment) (xref]. (li] (ol] [/topic/topic/body/section/ol/li {""}) Install the Splunk Add-on for VMware Metrics according to your type of deployment: (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/xref {"unresolved-reference"}) ERROR - unresolved reference (AddOns_released_VMWmetrics_InstallOverview__Deploy_the_Splunk_Add-on_for_VMware_Metrics_on-prem) (xref] (li] [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/xref {"unresolved-reference"}) ERROR - unresolved reference (ContentPackApp_2.3.0_Overview_Install__Install_the_Splunk_App_for_Content_Packs_on_a_distributed_environment) (xref] (li] (ol] [/topic/topic/body/section/ol/li {""}) Install the Splunk Add-on for VMware Metrics Indexes according to your type of deployment: (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/xref {"unresolved-reference"}) ERROR - unresolved reference (AddOns_released_VMWmetricsindexes_Install__Install_and_configure_in_an_on-premises_environment) (xref] (li] [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/xref {"unresolved-reference"}) ERROR - unresolved reference (AddOns_released_VMWmetricsindexes_Install__Install_and_configure_in_a_cloud_environment) (xref] (li] (ol]
[/topic/topic/body/section/p {""}) After following the previous steps, the deployment is installed as shown in the following table. (p] [/topic/topic/body/section/table {""}) [/topic/topic/body/section/table/tgroup {""}) [/topic/topic/body/section/table/tgroup/colspec {""}) (colspec] [/topic/topic/body/section/table/tgroup/colspec {""}) (colspec] [/topic/topic/body/section/table/tgroup/colspec {""}) (colspec] [/topic/topic/body/section/table/tgroup/colspec {""}) (colspec] [/topic/topic/body/section/table/tgroup/colspec {""}) (colspec] [/topic/topic/body/section/table/tgroup/colspec {""}) (colspec] [/topic/topic/body/section/table/tgroup/colspec {""}) (colspec] [/topic/topic/body/section/table/tgroup/thead {""}) [/topic/topic/body/section/table/tgroup/thead/row {""}) [/topic/topic/body/section/table/tgroup/thead/row/entry {""}) Component (entry] [/topic/topic/body/section/table/tgroup/thead/row/entry {""}) Search head (entry] [/topic/topic/body/section/table/tgroup/thead/row/entry {""}) Scheduler (entry] [/topic/topic/body/section/table/tgroup/thead/row/entry {""}) Indexer (entry] [/topic/topic/body/section/table/tgroup/thead/row/entry {""}) Data Collection[/topic/topic/body/section/table/tgroup/thead/row/entry/div {""}) (div]Node (DCN) (entry] [/topic/topic/body/section/table/tgroup/thead/row/entry {""}) ESXi log[/topic/topic/body/section/table/tgroup/thead/row/entry/div {""}) (div]forwarder (entry] [/topic/topic/body/section/table/tgroup/thead/row/entry {""}) vCenter log[/topic/topic/body/section/table/tgroup/thead/row/entry/div {""}) (div]forwarder (entry] (row] (thead] [/topic/topic/body/section/table/tgroup/tbody {""}) [/topic/topic/body/section/table/tgroup/tbody/row {""}) [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) Splunk App for VMware (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) Disabled (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] (row] [/topic/topic/body/section/table/tgroup/tbody/row {""}) [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) Splunk Add-on for VMware (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) Disabled (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) Disabled (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) Disabled (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] (row] [/topic/topic/body/section/table/tgroup/tbody/row {""}) [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) Splunk Add-on for ESXi Logs (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) ✓ (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) ✓ (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) ✓ (entry] (row] [/topic/topic/body/section/table/tgroup/tbody/row {""}) [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) Splunk Add-on for vCenter Logs (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) ✓ (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) ✓ (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) ✓ (entry] (row] [/topic/topic/body/section/table/tgroup/tbody/row {""}) [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) Splunk Add-on for VMware Indexes (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) ✓ (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] (row] [/topic/topic/body/section/table/tgroup/tbody/row {""}) [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) Splunk Add-on for VMware Extractions (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) Disabled (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] (row] [/topic/topic/body/section/table/tgroup/tbody/row {""}) [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) ITSI or IT Essentials Work (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) ✓ (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) ✓ (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] (row] [/topic/topic/body/section/table/tgroup/tbody/row {""}) [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) Splunk App for Content Packs (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) ✓ (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] (row] [/topic/topic/body/section/table/tgroup/tbody/row {""}) [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) Splunk Add-on for VMware Metrics (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) ✓ (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) ✓ (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] (row] [/topic/topic/body/section/table/tgroup/tbody/row {""}) [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) Splunk Add-on for VMware Metrics Indexes (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""}) ✓ (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] [/topic/topic/body/section/table/tgroup/tbody/row/entry {""})   (entry] (row] (tbody] (tgroup] (table] [/topic/topic/body/section/p {""}) Splunk Add-on for VMware Indexes is not automatically disabled or deleted from the environment to avoid data loss. After you are ready to use the Content Pack for VMware Dashboards and Reports and Splunk Add-on for VMware Metrics, you can follow the steps below to disable the app in your environment: (p] [/topic/topic/body/section/ol {""}) [/topic/topic/body/section/ol/li {""}) Navigate to [/topic/topic/body/section/ol/li/codeph {""}) {SPLUNK_HOME}/etc/apps/SA-VMWIndex/local/app.conf (codeph] (create app.conf file in local directory if it is not present) (li] [/topic/topic/body/section/ol/li {""}) Edit the "state" property of the "install" stanza as shown below: (li] [/topic/topic/body/section/ol/codeblock {""}) [install] state = disabled (codeblock] [/topic/topic/body/section/ol/li {""}) Restart the all the Search Heads present in your deployment. (li] [/topic/topic/body/section/ol/codeblock {""}) $SPLUNK_HOME/bin/splunk restart (codeblock] (ol]
[/topic/topic/body/section {""}) [/topic/topic/body/section/title {""}) After you migrate (title] [/topic/topic/body/section/p {""}) Perform the steps below on each search head in your deployment: (p] [/topic/topic/body/section/ol {""}) [/topic/topic/body/section/ol/li {""}) Move the following directories from the App package to the [/topic/topic/body/section/ol/li/codeph {""}) DA-ITSI-CP-vmware-dashboards (codeph] folder that you backed up while going through the procedure in the "Before you migrate" section: (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/b {""}) /local (b] directory from [/topic/topic/body/section/ol/ol/li/codeph {""}) splunk_for_vmware (codeph] that contains all the local configurations under conf files (li] [/topic/topic/body/section/ol/ol/li {""}) [/topic/topic/body/section/ol/ol/li/b {""}) /lookups (b] directory from [/topic/topic/body/section/ol/ol/li/codeph {""}) splunk_for_vmware (codeph] that contains the CSV lookups (li] (ol] [/topic/topic/body/section/ol/li {""}) Move the [/topic/topic/body/section/ol/li/codeph {""}) datamodels.conf (codeph] configuration file from the local folder of the [/topic/topic/body/section/ol/li/b {""}) SA-VMW-HierarchyInventory (b] package to the[/topic/topic/body/section/ol/li/div {""}) (div] [/topic/topic/body/section/ol/li/codeph {""}) DA-ITSI-CP-vmware-dashboards/local/ (codeph] package. (li] [/topic/topic/body/section/ol/li {""}) Move the following lookups files from the [/topic/topic/body/section/ol/li/b {""}) SA-VMW-HierarchyInventory (b] package to [/topic/topic/body/section/ol/li/codeph {""}) DA-ITSI-CP-vmware-dashboards/lookups/ (codeph] package: (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) DatastoreList.csv (li] [/topic/topic/body/section/ol/ol/li {""}) FullHierarchy.csv (li] [/topic/topic/body/section/ol/ol/li {""}) TimeAboutHost.csv (li] [/topic/topic/body/section/ol/ol/li {""}) TimeClusterServicesAvailability.csv (li] [/topic/topic/body/section/ol/ol/li {""}) TimeDatastoreSummary.csv (li] [/topic/topic/body/section/ol/ol/li {""}) TimeDatastoreSummary.csv (li] [/topic/topic/body/section/ol/ol/li {""}) TimeInvHostHardwareAndLicense.csv (li] [/topic/topic/body/section/ol/ol/li {""}) UniqueNameLookup.csv (li] (ol] [/topic/topic/body/section/ol/li {""}) Move the following lookups files from the [/topic/topic/body/section/ol/li/b {""}) SA-VMW-Performance (b] package to the [/topic/topic/body/section/ol/li/codeph {""}) DA-ITSI-CP-vmware-dashboards/lookups/ (codeph] package (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) ACFields.csv (li] [/topic/topic/body/section/ol/ol/li {""}) HSFieldList.csv (li] [/topic/topic/body/section/ol/ol/li {""}) HSInstanceList.csv (li] (ol] [/topic/topic/body/section/ol/li {""}) Move the following lookups files from the [/topic/topic/body/section/ol/li/b {""}) SA-VMW-LogEventTask (b] package to the [/topic/topic/body/section/ol/li/codeph {""}) DA-ITSI-CP-vmware-dashboards/lookups/ (codeph] package. (li] [/topic/topic/body/section/ol/ol {""}) [/topic/topic/body/section/ol/ol/li {""}) vmware_event_lookup.csv (li] [/topic/topic/body/section/ol/ol/li {""}) vmware_task_lookup.csv (li] (ol] [/topic/topic/body/section/ol/li {""}) Remove the [/topic/topic/body/section/ol/li/b {""}) app.conf f (b]ile from the [/topic/topic/body/section/ol/li/codeph {""}) DA-ITSI-CP-vmware-dashboards/local (codeph] directory. (li] [/topic/topic/body/section/ol/li {""}) Restart the instance. [/topic/topic/body/section/ol/li/codeblock {""}) $SPLUNK_HOME/bin/splunk restart (codeblock] (li] (ol] (section] [/topic/topic/body/section {""}) [/topic/topic/body/section/title {""}) Install and configure the content pack (title] [/topic/topic/body/section/ol {""}) [/topic/topic/body/section/ol/li {""}) Make sure the VMware data collected using Splunk Add-on for VMware Metrics (v4.2.0 or higher) is searchable from the search head where you installed the Splunk App for Content Packs. (li] [/topic/topic/body/section/ol/li {""}) Install and configure [/topic/topic/body/section/ol/li/xref {"unresolved-reference"}) ERROR - unresolved reference (ITSICP_current_Config_ConfigVMWDash) (xref]. (li] [/topic/topic/body/section/ol/li {""}) Configure data collection for [/topic/topic/body/section/ol/li/xref {"unresolved-reference"}) ERROR - unresolved reference (ITSICP_current_Config_ConfigVMWData) (xref]. (li] (ol] (section] [/topic/topic/body/section {""}) [/topic/topic/body/section/title {""}) Access the dashboards in the content pack (title] [/topic/topic/body/section/p {""}) You can now access the dashboards from the content pack: (p] [/topic/topic/body/section/ol {""}) [/topic/topic/body/section/ol/li {""}) In Splunk Web, open IT Service Intelligence or IT Essentials Work. (li] [/topic/topic/body/section/ol/li {""}) From the main navigation bar choose [/topic/topic/body/section/ol/li/b {""}) Dashboards > Dashboards (b]. (li] [/topic/topic/body/section/ol/li {""}) From the list of dashboards, those with the suffix [/topic/topic/body/section/ol/li/b {""}) - VMware (b] are from the Content Pack for VMware Dashboards and Reports. Select the dashboard title to open the dashboard. (li] [/topic/topic/body/section/ol/li {""}) Remove the [/topic/topic/body/section/ol/li/codeph {""}) {SPLUNK_HOME}/etc/apps/splunk_for_vmware , {SPLUNK_HOME}/etc/apps/SA-VMW-Performance, {SPLUNK_HOME}/etc/apps/SA-Threshold, {SPLUNK_HOME}/etc/apps/SA-VMW-LogEventTask, {SPLUNK_HOME}/etc/apps/SA-VMNetAppUtils, {SPLUNK_HOME}/etc/apps/SA-VMW-HierarchyInventory, {SPLUNK_HOME}/etc/apps/TA-VMW-FieldExtractions, {SPLUNK_HOME}/etc/apps/Splunk_TA_vmware (codeph], and [/topic/topic/body/section/ol/li/codeph {""}) {SPLUNK_HOME}/etc/apps/SA-Hydra (codeph] directories to use the Content Pack for VMware Dashboards and Reports. (li] (ol] (section]