Action definition
Actions are defined within stanzas in the engine.conf file. They correspond to the type(s) of data you want to collect. There is an action keyword for each kind of data collected. For example, hierarchy data is collected using the the action HierarchyDiscovery in engine.conf. You can define multiple actions for a single target machine.
action | Description |
---|---|
InventoryDiscovery | Collects a large volume of data and as a result can be slow to process it. The larger the environment the bigger the impact on data collection. For larger environments, we recommend that you create an engine.conf file that is dedicated to collecting inventory data with low interval values between stanzas.. For very large environments, that may be more volatile , or where there are multiple VCs we recommend that you create sets of engine.conf files with low interval values between stanzas. |
HierarchyDiscovery | Crawls a large volume of data and as a result can be slow to collect an entire snapshot. especially when there are several VCs and lots of ESX/i hosts. We recommended putting this action into its own engine.conf, running it separately from other modules, and using a low interval value. |
PerfDiscovery | Execution times for this module vary widely. We recommended that you put this action into its own FA VM (with or without performance filters) if gathering near real-time performance data is important. By default, ESX/i hosts only store one hour of historical performance data, so all elements on the host must be gathered at least once per hour. The module can be configured to collect data at a faster rate than the default setting. |
TaskDiscovery | This module is fast and can run for a long time on startup if you have it set to gather historical data. We recommend that you gather this data at less than 5 minute intervals because that is the timeout on the VMware “recent tasks” queue. |
EventDiscovery | This module is fast and can run for a long time on startup if you have it set to gather historical data. We recommend that you gather this data at roughly 5 minute intervals. |
LogDiscovery | The performance of this module falls between the faster and slower modules. This module retrieves log entries using the last line accessed, although it is important to note that the log rotation performed internally by ESX/i can cause gaps in the data collection. In general, for large environments run this module faster than other modules to reduce the chance for data gaps, and when they occur, keep the gaps as small as possible. We recommend that you run this at 3 - 30 second intervals (if no other actions are running) because VMware tends to generate a lot of log data in a very short period of time, even in a simple environment that is not very active. |
This documentation applies to the following versions of Splunk® App for VMware (Legacy): 1.0, 1.0.1
Feedback submitted, thanks!