Splunk® App for VMware (Legacy)

Installation and Configuration Guide

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.

Action definition

Actions are defined within stanzas in the engine.conf file. They correspond to the type(s) of data you want to collect. There is an action keyword for each kind of data collected. For example, hierarchy data is collected using the the action HierarchyDiscovery in engine.conf. You can define multiple actions for a single target machine.


action Description
InventoryDiscovery Collects a large volume of data and as a result can be slow to process it. The larger the environment the bigger the impact on data collection. For larger environments, we recommend that you create an engine.conf file that is dedicated to collecting inventory data with low interval values between stanzas.. For very large environments, that may be more volatile , or where there are multiple VCs we recommend that you create sets of engine.conf files with low interval values between stanzas.
HierarchyDiscovery Crawls a large volume of data and as a result can be slow to collect an entire snapshot. especially when there are several VCs and lots of ESX/i hosts. We recommended putting this action into its own engine.conf, running it separately from other modules, and using a low interval value.
PerfDiscovery Execution times for this module vary widely. We recommended that you put this action into its own FA VM (with or without performance filters) if gathering near real-time performance data is important. By default, ESX/i hosts only store one hour of historical performance data, so all elements on the host must be gathered at least once per hour. The module can be configured to collect data at a faster rate than the default setting.
TaskDiscovery This module is fast and can run for a long time on startup if you have it set to gather historical data. We recommend that you gather this data at less than 5 minute intervals because that is the timeout on the VMware “recent tasks” queue.
EventDiscovery This module is fast and can run for a long time on startup if you have it set to gather historical data. We recommend that you gather this data at roughly 5 minute intervals.
LogDiscovery The performance of this module falls between the faster and slower modules. This module retrieves log entries using the last line accessed, although it is important to note that the log rotation performed internally by ESX/i can cause gaps in the data collection. In general, for large environments run this module faster than other modules to reduce the chance for data gaps, and when they occur, keep the gaps as small as possible. We recommend that you run this at 3 - 30 second intervals (if no other actions are running) because VMware tends to generate a lot of log data in a very short period of time, even in a simple environment that is not very active.
Last modified on 10 July, 2012
 

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 1.0, 1.0.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters