Splunk® Supported Add-ons

Splunk Add-on for Microsoft Hyper-V

Download manual as PDF

Download topic as PDF

Configure inputs for the Splunk Add-on for Microsoft Hyper-V

The Splunk Add-on for Microsoft Hyper-V collects data through the Splunk platform's native PowerShell and peformance monitoring, and event log collection capabilities. After you install the add-on to the forwarder installed on your Microsoft Hyper-V server, you need to configure the forwarder to collect data.

The table below lists the inputs you can enable through Microsoft PowerShell, Performance monitor, and Windows event log

Type Input Name
PowerShell v3 inputs DatastorePerfMetrics

GetHypervisor_Inventory
GetHypervisor_InventoryEXT
GetHypervisor_SwitchEXT
GetVM_DiskEXT
GetVM_Inventory
GetVM_InventoryEXT
GetVM_NetworkEXT
HypervisorPerfMetrics
VMPerfMetrics

Local performance monitoring HyperV_Hypervisor

HyperV_Legacy_Network
HyperV_Logical_Processor
HyperV_Network
HyperV_Partition
HyperV_Root_Partition
HyperV_Root_Processor
HyperV_VM_Health
HyperV_VM_Summary
HyperV_VM_VID_Partition
HyperV_Virtual_Processor
HyperV_Virtual_Storage_Device
HyperV_Virtual_Switch

Event log collection Microsoft-Windows-Hyper-V-Config-Admin

Microsoft-Windows-Hyper-V-Hypervisor-Admin
Microsoft-Windows-Hyper-V-Hypervisor-Operational
Microsoft-Windows-Hyper-V-Synthnic-Admin
Microsoft-Windows-Hyper-V-Synthtor-Admin
Microsoft-Windows-Hyper-V-Synthtor-Operational
Microsoft-Windows-Hyper-V-VMMS-Admin
Microsoft-Windows-Hyper-V-Worker-Admin

If your forwarder has Splunk Web enabled, you can use Splunk Web to configure inputs. If your forwarder does not have Splunk Web, configure your inputs in inputs.conf.

Configure inputs through Splunk Web

  1. Log into Splunk Web on the forwarder installed on your Microsoft Hyper-V server.
  2. Select Settings > Data inputs > Local inputs.
  3. Select PowerShell v3 Modular Input and click Enable to enable the type of data you want to collect via Microsoft PowerShell.
  4. Select Local performance monitoring and click Enable to enable the type of data you want to collect via performance monitor.
  5. Select Event log collection and click Enable to enable the type of data you want to collect via windows event log.
  6. (Optional) If you want to increase the collection interval for larger deployments, click the input metric and modify the CRON schedule for the PowerShell input or decrease the frequency of script running for the performance input.

Configure inputs through inputs.conf

  1. Create a file named inputs.conf in %SPLUNK_HOME%\etc\apps\Splunk_TA_microsoft-hyperv\local folder.
  2. Open inputs.conf file in %SPLUNK_HOME%\etc\apps\Splunk_TA_microsoft-hyperv\default and copy the stanzas that you want to the local file you just created.
  3. Change the disabled=1 to disabled=0 for each input that you want to enable.
  4. (Optional) To increase the collection interval for larger deployments, modify the CRON schedule for the PowerShell inputs or increase the interval for the performance monitoring scripts.
  5. Save the file.
  6. Restart the forwarder.
Last modified on 09 April, 2019
PREVIOUS
Upgrade the Splunk Add-on for Microsoft Hyper-V
  NEXT
Troubleshoot the Splunk Add-on for Microsoft Hyper-V

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters