Data collection configuration file reference for the Splunk Add-on for VMware Metrics
Edit the inframon_ta_vmware_collection.conf file on the scheduler to enable or disable instance-level data and to configure the index for performance, inventory, or task-event data collection. You can find the specification for inframon_ta_vmware_collection.conf in Splunk_TA_vmware_inframon/bin/ta_vmware_inframon/models.py.
[default] #atomic task confirmation expirations automatically unlock jobs after the elapsed time even if a completion or failure has not been logged. The defaults are double interval. #hostinv_confirmation_expiration = 1800 #vminv_confirmation_expiration = 1800 #These are the destination indexes for the different data types perf_index = vmware-perf-metrics inv_index = vmware-inv taskevent_index = vmware-taskevent # Object count value in API response for inventory collector # This values has to be greater than equal to 1. If you set this value with higher value then hostinv will take more memory # to process the api response. If you set this value too low then it increases the load on VC as API calls increase. #inv_maxObjUpdates = 20 # The number to add to the priority number for jobs of a given task, negative number makes higher priority task_priority = -60 event_priority = -60 hierarchyinv_priority = -120 #Performance format type. This is used to define format which is used to retrieve perf data form vmware. Make sure it has value either csv or normal perf_format_type = csv # datagen flags for internal use only autoeventgen = false autoeventgen_poweroff_vmcount = 0 # The following lines should NOT be commented if you want to collect instance level data # host_instance_allowlist = .* # vm_instance_allowlist = .* # cluster_instance_allowlist = .* deployment_type = VMware
Edit inframon_ta_vmware_pool.conf on the scheduler to configure the tasks for which the data collection jobs will be created and their interval and expiration.
[Global pool] description = This is a default pool template_name = Global pool task = hostvmperf, clusterperf, hostinv, vminv, clusterinv, datastoreinv, hierarchyinv, task, event, vcperf, datastoreperf #These are the tasks that should be considered atomic and not generate jobs until the previous run completes atomic_tasks = hostinv, vminv hostvmperf_interval = 180 # Setting interval to < 30 min results in missing cluster data clusterperf_interval = 2000 vcperf_interval = 1800 datastoreperf_interval = 600 hostinv_interval = 900 vminv_interval = 900 clusterinv_interval = 1800 datastoreinv_interval = 900 hierarchyinv_interval = 300 task_interval = 300 event_interval = 300 #The following are the expiration periods for particular tasks hostvmperf_expiration = 180 clusterperf_expiration = 1900 vcperf_expiration = 1800 datastoreperf_expiration = 600 task_expiration = 3600 event_expiration = 3600 hostinv_expiration = 900 vminv_expiration = 900 clusterinv_expiration = 1800 datastoreinv_expiration = 900 hierarchyinv_expiration = 300
Configure Metrics Allowlist/Denylist to filter performance data
The Splunk Add-on for VMware Metrics supports metrics allowlist/denylist to filter the performance data for Host, VM, Cluster, and vCenter. See the following examples to use this feature.
Per the default configurations, the add-on collects limited metrics for all entities into the metrics index. You can collect all metrics available on vCenter by removing the configured metrics against <entity>_metric_allowlist. For example, Iif both the allowlist and denylist parameters are empty, the add-on collects all the metrics available at the vCenter.
The Splunk Add-on for VMware Metrics indexes the Inventory fields of the datastore (Capacity, FreeSpace and Used Percent) into the metrics index for each datastore entity present in the vCenter server. Because the inventory fields are indexed into the performance data of the datastore, the functionality to filter performance metrics (allowlist/denylist) is not supported for datastore entities.
On the scheduler, edit the inframon_ta_vmware_template.conf file in the local directory of etc/apps/Splunk_TA_vmware_inframon to filter (i.e. allow or deny) metrics to be collected for Host, VM, Cluster, or vCenter performance data by configuring the respective entity parameters. You can find the specification for inframon_ta_vmware_template.conf in Splunk_TA_vmware_inframon/README/inframon_ta_vmware_template.conf.spec.
The following are the default parameters in the Splunk_TA_vmware_inframon/default/inframon_ta_vmware_template.conf:
[Global pool] host_metric_allowlist = "cpu.average.reservedCapacity.megaHertz", "cpu.average.totalCapacity.megaHertz", "cpu.average.demand.megaHertz", "cpu.average.usage.percent", "mem.average.reservedCapacity.megaBytes", "mem.average.totalCapacity.megaBytes", "mem.average.consumed.kiloBytes", "mem.average.swapinRate.kiloBytesPerSecond", "mem.average.swapoutRate.kiloBytesPerSecond", "datastore.average.read.kiloBytesPerSecond", "datastore.average.write.kiloBytesPerSecond", "datastore.average.numberReadAveraged.number", "datastore.average.numberWriteAveraged.number", "datastore.average.totalReadLatency.millisecond", "datastore.average.totalWriteLatency.millisecond", "mem.average.llSwapUsed.kiloBytes", "mem.average.vmmemctl.kiloBytes", "net.average.received.kiloBytesPerSecond", "net.average.transmitted.kiloBytesPerSecond", "net.summation.packetsRx.number", "net.summation.packetsTx.number", "power.average.power.watt", "hbr.average.hbrNetTx.kiloBytesPerSecond", "hbr.average.hbrNetRx.kiloBytesPerSecond", "cpu.average.usagemhz.megaHertz", "mem.average.overhead.kiloBytes", "mem.average.active.kiloBytes", "mem.average.shared.kiloBytes", "mem.average.compressed.kiloBytes", "mem.average.swapin.kiloBytes", "mem.average.swapout.kiloBytes", "cpu.average.reservedAllocation.percent", "cpu.average.unreservedAllocation.percent", "mem.average.reservedAllocation.percent", "mem.average.swapped.kiloBytes", "mem.average.usage.percent" vm_metric_allowlist = "cpu.latest.demandEntitlementRatio.percent", "cpu.average.usagemhz.megaHertz", "cpu.average.usage.percent", "cpu.summation.ready.millisecond", "mem.average.consumed.kiloBytes", "mem.average.granted.kiloBytes", "mem.average.vmmemctltarget.kiloBytes", "mem.average.vmmemctl.kiloBytes", "mem.average.active.kiloBytes", "mem.average.usage.percent", "datastore.average.totalReadLatency.millisecond", "datastore.average.totalWriteLatency.millisecond", "datastore.average.read.kiloBytesPerSecond", "datastore.average.write.kiloBytesPerSecond", "net.average.received.kiloBytesPerSecond", "net.average.transmitted.kiloBytesPerSecond", "net.summation.packetsRx.number", "net.summation.packetsTx.number", "power.average.power.watt", "mem.average.overhead.kiloBytes", "mem.average.shared.kiloBytes", "mem.average.compressed.kiloBytes", "mem.average.swapped.kiloBytes", "datastore.average.storage_committed.bytes","datastore.average.storage_uncommitted.bytes", "datastore.average.storage_used_percent.percent", "disk.average.usage.kiloBytesPerSecond" cluster_metric_allowlist = (?!cpu.average.reservedCapacity.megaHertz).*(clusterServices|cpu).* # adding on demand aggregated cluster metrics as denylist which hits the maxQueryMetrics limit cluster_metric_denylist = (cpu.(maximum|minimum).(usagemhz.megaHertz|usage.percent)|cpu.average.corecount.contention.percent) vc_metric_allowlist = "vcResources.average.virtualmemusage.kiloBytes", "vcResources.average.systemcpuusage.percent", "vcResources.average.physicalmemusage.kiloBytes"
To collect all metrics available on vCenter for host and VM entity, put blank as a value or .* regex.
[Global pool] host_metric_allowlist = vm_metric_allowlist = .*
Use regex to restrict CPU metrics to be collected for host.
[Global pool] // Regex should have format: group.rollup.metric.unit (cpu.average.usage.percent) host_metric_denylist = cpu.*
Use regex to restrict specific metrics to be collected for vCenter. Below is an example of how to restrict the collection of vCenter's performance metrics having kiloBytes as a unit.
[Global pool] // Regex should have format: group.rollup.metric.unit (vcResources.average.virtualmemusage.kiloBytes) vc_metric_denylist = vcResources.*.kiloBytes
Inventory fields reference for the Splunk Add-on for VMware Metrics
Hydra troubleshooting searches in the Splunk Add-on for VMware Metrics
This documentation applies to the following versions of Splunk® Supported Add-ons: released
Feedback submitted, thanks!