Configure inputs for the Splunk Add-on for Microsoft Hyper-V

The Splunk Add-on for Microsoft Hyper-V collects data through the Splunk platform's native PowerShell and performance monitoring, and event log collection capabilities. After you install the add-on to the forwarder installed on your Microsoft Hyper-V server, you need to configure the forwarder to collect data.

The table below lists the inputs you can enable through Microsoft PowerShell, Performance monitor, and Windows event log

Type	Input Name
PowerShell v3 inputs	DatastorePerfMetrics GetHypervisor_Inventory GetHypervisor_InventoryEXT GetHypervisor_SwitchEXT GetVM_DiskEXT GetVM_Inventory GetVM_InventoryEXT GetVM_NetworkEXT HypervisorPerfMetrics VMPerfMetrics
Local performance monitoring	HyperV_Hypervisor HyperV_Legacy_Network HyperV_Logical_Processor HyperV_Network HyperV_Partition HyperV_Root_Partition HyperV_Root_Processor HyperV_VM_Health HyperV_VM_Summary HyperV_VM_VID_Partition HyperV_Virtual_Processor HyperV_Virtual_Storage_Device HyperV_Virtual_Switch
Event log collection	Microsoft-Windows-Hyper-V-Config-Admin Microsoft-Windows-Hyper-V-Config-Operational Microsoft-Windows-Hyper-V-Hypervisor-Admin Microsoft-Windows-Hyper-V-Hypervisor-Operational Microsoft-Windows-Hyper-V-Image-Management-Service-Admin Microsoft-Windows-Hyper-V-Image-Management-Service-Operational Microsoft-Windows-Hyper-V-Intergration-Admin Microsoft-Windows-Hyper-V-Network-Admin Microsoft-Windows-Hyper-V-Network-Operational Microsoft-Windows-Hyper-V-SynthNic-Admin Microsoft-Windows-Hyper-V-SynthNic-Operational Microsoft-Windows-Hyper-V-VMMS-Admin Microsoft-Windows-Hyper-V-Worker-Admin Microsoft-Windows-Hyper-V-SynthStor-Admin Microsoft-Windows-Hyper-V-SynthStor-Operational Microsoft-Windows-Hyper-V-Compute-Admin Microsoft-Windows-Hyper-V-VmSwitch-Operational Microsoft-Windows-Hyper-V-VMMS-Networking Microsoft-Windows-Hyper-V-VMMS-Operational

If your forwarder has Splunk Web enabled, you can use Splunk Web to configure inputs. If your forwarder does not have Splunk Web, configure your inputs in inputs.conf.

Configure inputs through Splunk Web

1. Log into Splunk Web on the forwarder installed on your Microsoft Hyper-V server.
2. Select Settings > Data inputs > Local inputs.
3. Select PowerShell v3 Modular Input and click Enable to enable the type of data you want to collect via Microsoft PowerShell.
4. Select Local performance monitoring and click Enable to enable the type of data you want to collect via performance monitor.
5. Select Event log collection and click Enable to enable the type of data you want to collect via windows event log.
6. (Optional) If you want to increase the collection interval for larger deployments, click the input metric and modify the CRON schedule for the PowerShell input or decrease the frequency of script running for the performance input.

Configure inputs through inputs.conf

1. Create a file named inputs.conf in %SPLUNK_HOME%\etc\apps\Splunk_TA_microsoft-hyperv\local folder.
2. Open inputs.conf file in %SPLUNK_HOME%\etc\apps\Splunk_TA_microsoft-hyperv\default and copy the stanzas that you want to the local file you just created.
3. Change the disabled=1 to disabled=0 for each input that you want to enable.
4. (Optional) To increase the collection interval for larger deployments, modify the CRON schedule for the PowerShell inputs or increase the interval for the performance monitoring scripts.
5. Save the file.
6. Restart the forwarder.