Splunk® Supported Add-ons

Splunk Add-on for VMware

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Data collection configuration file reference

Edit ta_vmware_collection.conf on the scheduler to enable or disable instance level data and to allow or deny metric collection. You can find the specification for ta_vmware_collection.conf in Splunk_TA_vmware/bin/ta_vmware/models.py.


  # Copyright (C) 2005-2021 Splunk Inc. All Rights Reserved. 

[default]
#These are all the tasks that should run everywhere
task = hostvmperf, otherperf, hierarchyinv, hostinv, vminv, clusterinv, datastoreinv, rpinv, task, event
#These are the tasks that should be considered atomic and not generate jobs until the previous run completes
atomic_tasks = hostinv, vminv
#atomic task confirmation expirations automatically unlock jobs after the elapsed time even if a completion or failure has not been logged. The defaults are double interval.
#hostinv_confirmation_expiration = 1800
#vminv_confirmation_expiration = 1800

#These are the destination indexes for the different data types
perf_index = vmware-perf
inv_index = vmware-inv
taskevent_index = vmware-taskevent
# Object count value in API response for inventory collector
# This values has to be greater than equal to 1. If you set this value with higher value then hostinv will take more memory
# to process the api response. If you set this value too low then it increases the load on VC as API calls increase.
#inv_maxObjUpdates = 20
#The following are the collection intervals for particular tasks
hostvmperf_interval = 180
# Setting interval to < 30 min results in missing cluster data
otherperf_interval = 2000 
hierarchyinv_interval = 300
hostinv_interval = 900
vminv_interval = 900
clusterinv_interval = 1800
datastoreinv_interval = 900
rpinv_interval = 900
task_interval = 300
event_interval = 300
#The following are the expiration periods for particular tasks
hostvmperf_expiration = 180
otherperf_expiration = 1900
task_expiration = 3600
event_expiration = 3600
hierarchyinv_expiration = 300
hostinv_expiration = 900
vminv_expiration = 900
clusterinv_expiration = 1800
datastoreinv_expiration = 900
rpinv_expiration = 900

# The number to add to the priority number for jobs of a given task, negative number makes higher priority
task_priority = -60
event_priority = -60
hierarchyinv_priority = -120

#Performance format type. This is used to define format which is used to retrieve perf data form vmware. Make sure it has value either csv or normal
perf_format_type = csv
# For HostSystem Inv, only config.hyperThread is collected by default
# Add other properties as follows, example:
# hostsystem_inv_config = config.adminDisabled, config.host 
# Default allowlists / denylists for entities:
# resource pools should be turned off
perf_entity_denylist = ^ResourcePool$
# Default allowlists / denylists for metrics:
# for clusters, only clusterServices counter group should be collected
cluster_metric_allowlist = ^p_(?!average_cpu_reservedCapacity_megaHertz).*_(clusterServices|cpu).*
# adding on demand aggregated metrics as denylist
cluster_metric_denylist = ^p_((maximum|minimum)_(cpu_usagemhz_megaHertz|cpu_usage_percent)|average_cpu_corecount.contention_percent)
# datagen flags for internal use only
autoeventgen = false
autoeventgen_poweroff_vmcount = 0

# The following lines should NOT be commented if you want to collect instance level data
# host_instance_allowlist = .*
# vm_instance_allowlist = .*
# rp_instance_allowlist = .*
# cluster_instance_allowlist = .*

deployment_type = VMware
Last modified on 21 July, 2021
PREVIOUS
Performance metrics reference
  NEXT
Data model acceleration configuration file reference

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters