splunk
VMWare Horizon 8 Add-on
Splunk Cloud
Overview
Details
This add-on is for the extraction of vdm logs on connection servers as well as mapping syslog from Horizon to the CIM. I focused on the authentication datamodel for these so there is probably room to improve it overall.
VMWare Horizon Add-on
Overview
- This add-on is for the extraction of vdm logs on connection servers as well as mapping syslog from Horizon to the CIM. I focused on the authentication datamodel for these so there is probably room to improve it overall.
Where to install this add-on
This table provides a reference for installing this specific add-on to a distributed deployment of the Splunk platform.
| Splunk instance type | Supported | Required | Comments |
|---|---|---|---|
| Search Heads | Yes | Yes | Install this add-on to all search heads where VMWare Horizon knowledge management is required. |
| Indexers | Yes | Conditional | Not required if you use heavy forwarders to collect data. Required if you use universal forwarders to collect data. |
| Heavy Forwarders | Yes | See comments | This add-on supports forwarders of any type for data collection. The host must run on a supported version of Windows. The add-on must be installed on Heavy Forwarders if your deployment consists of heavy forwarder and indexer. |
| Universal Forwarders | Yes | See comments | Only required for vdm logs on connection servers if needed. |
Distributed deployment feature compatibility
This table describes the compatibility of this add-on with Splunk distributed deployment features.
| Distributed deployment feature | Supported | Comments |
|---|---|---|
| Search Head Clusters | Yes | You can install this add-on on a search head cluster for all search-time functionality, but configure inputs on forwarders to avoid duplicate data collection. inputs.conf example has inputs disabled by default. |
| Indexer Clusters | Yes | Add-on has a sourcetype transforms that may require the add-on to be published on indexers. If collecting from heavy forwarder you shouldn't need to deploy on indexer clusters. |
| Deployment Server | Yes | Supported for deploying the configured add-on to multiple nodes. |
Setup Horizon for syslog
- This is the primary data for horizon activity
- To configure syslog log into your admin console
- Select Settings > Event Configuration
- Click add in the syslog area to add a syslog server.
- Enter the DNS name and the UDP port the syslog server is listening on.
Example Syslog input
[udp://9514]
disabled = false
connection_host = ip
sourcetype = vm:hzn:syslog
index = vmware-horizon
- I recommend using syslog-ng or SC4S if you can.
Release Notes
Version 1.0.0
June 20, 2024
VMWare Horizon Add-on
Overview
- This add-on is for the extraction of vdm logs on connection servers as well as mapping syslog from Horizon to the CIM. I focused on the authentication datamodel for these so there is probably room to improve it overall.
Where to install this add-on
Unless otherwise noted, all supported add-ons can be safely installed to all tiers of a distributed Splunk platform deployment. See Where to install Splunk add-ons in Splunk Add-ons for more information.
This table provides a reference for installing this specific add-on to a distributed deployment of the Splunk platform.
| Splunk instance type | Supported | Required | Comments |
|---|---|---|---|
| Search Heads | Yes | Yes | Install this add-on to all search heads where VMWare Horizon knowledge management is required. |
| Indexers | Yes | Conditional | Not required if you use heavy forwarders to collect data. Required if you use universal forwarders to collect data. |
| Heavy Forwarders | Yes | See comments | This add-on supports forwarders of any type for data collection. The host must run on a supported version of Windows. The add-on must be installed on Heavy Forwarders if your deployment consists of heavy forwarder and indexer. |
| Universal Forwarders | Yes | See comments | Only required for vdm logs on connection servers if needed. |
Distributed deployment feature compatibility
This table describes the compatibility of this add-on with Splunk distributed deployment features.
| Distributed deployment feature | Supported | Comments |
|---|---|---|
| Search Head Clusters | Yes | You can install this add-on on a search head cluster for all search-time functionality, but configure inputs on forwarders to avoid duplicate data collection. inputs.conf example has inputs disabled by default. |
| Indexer Clusters | Yes | Add-on has a sourcetype transforms that may require the add-on to be published on indexers. If collecting from heavy forwarder you shouldn't need to deploy on indexer clusters. |
| Deployment Server | Yes | Supported for deploying the configured add-on to multiple nodes. |
| ## Setup Horizon for syslog | ||
| - This is the primary data for horizon activity | ||
| - To configure syslog log into your admin console | ||
| - Select Settings > Event Configuration | ||
| - Click add in the syslog area to add a syslog server. | ||
| - Enter the DNS name and the UDP port the syslog server is listening on. |
Example Syslog input
[udp://9514]
disabled = false
connection_host = ip
sourcetype = vm:hzn:syslog
index = vmware-horizon
- I recommend using syslog-ng or SC4S if you can.