Data collection configuration file reference for the Splunk Add-on for VMware Metrics

Edit the inframon_ta_vmware_collection.conf file on the scheduler to enable or disable instance-level data and to configure the index for performance, inventory, or task-event data collection. You can find the specification for inframon_ta_vmware_collection.conf in Splunk_TA_vmware_inframon/bin/ta_vmware_inframon/models.py.

[default]
#atomic task confirmation expirations automatically unlock jobs after the elapsed time even if a completion or failure has not been logged. The defaults are double interval.
#hostinv_confirmation_expiration = 1800
#vminv_confirmation_expiration = 1800
#These are the destination indexes for the different data types
perf_index = vmware-perf-metrics
inv_index = vmware-inv
taskevent_index = vmware-taskevent
# Object count value in API response for inventory collector
# This values has to be greater than equal to 1. If you set this value with higher value then hostinv will take more memory
# to process the api response. If you set this value too low then it increases the load on VC as API calls increase.
#inv_maxObjUpdates = 20
# The number to add to the priority number for jobs of a given task, negative number makes higher priority
task_priority = -60
event_priority = -60
hierarchyinv_priority = -120
#Performance format type. This is used to define format which is used to retrieve perf data form vmware. Make sure it has value either csv or normal
perf_format_type = csv
# datagen flags for internal use only
autoeventgen = false
autoeventgen_poweroff_vmcount = 0
# The following lines should NOT be commented if you want to collect instance level data
# host_instance_allowlist = .*
# vm_instance_allowlist = .*
# cluster_instance_allowlist = .*
deployment_type = VMware

Edit inframon_ta_vmware_pool.conf on the scheduler to configure the tasks for which the data collection jobs will be created and their interval and expiration.

[Global pool]
description = This is a default pool
template_name = Global pool
task = hostvmperf, clusterperf, hostinv, vminv, clusterinv, datastoreinv, hierarchyinv, task, event, vcperf, datastoreperf
#These are the tasks that should be considered atomic and not generate jobs until the previous run completes
atomic_tasks = hostinv, vminv
hostvmperf_interval = 180
# Setting interval to < 30 min results in missing cluster data
clusterperf_interval = 2000 
vcperf_interval = 1800
datastoreperf_interval = 600
hostinv_interval = 900
vminv_interval = 900
clusterinv_interval = 1800
datastoreinv_interval = 900
hierarchyinv_interval = 300
task_interval = 300
event_interval = 300
#The following are the expiration periods for particular tasks
hostvmperf_expiration = 180
clusterperf_expiration = 1900
vcperf_expiration = 1800
datastoreperf_expiration = 600
task_expiration = 3600
event_expiration = 3600
hostinv_expiration = 900
vminv_expiration = 900
clusterinv_expiration = 1800
datastoreinv_expiration = 900
hierarchyinv_expiration = 300

Configure Metrics Allowlist/Denylist to filter performance data

The Splunk Add-on for VMware Metrics supports metrics allowlist/denylist to filter the performance data for Host, VM, Cluster, and vCenter. See the following examples to use this feature.

Per the default configurations, the add-on collects limited metrics for all entities into the metrics index. You can collect all metrics available on vCenter by removing the configured metrics against <entity>_metric_allowlist. For example, Iif both the allowlist and denylist parameters are empty, the add-on collects all the metrics available at the vCenter.

The Splunk Add-on for VMware Metrics indexes the Inventory fields of the datastore (Capacity, FreeSpace and Used Percent) into the metrics index for each datastore entity present in the vCenter server. Because the inventory fields are indexed into the performance data of the datastore, the functionality to filter performance metrics (allowlist/denylist) is not supported for datastore entities.

On the scheduler, edit the inframon_ta_vmware_template.conf file in the local directory of etc/apps/Splunk_TA_vmware_inframon to filter (i.e. allow or deny) metrics to be collected for Host, VM, Cluster, or vCenter performance data by configuring the respective entity parameters. You can find the specification for inframon_ta_vmware_template.conf in Splunk_TA_vmware_inframon/README/inframon_ta_vmware_template.conf.spec.

The following are the default parameters in the Splunk_TA_vmware_inframon/default/inframon_ta_vmware_template.conf:

[Global pool]
host_metric_allowlist = "cpu.average.reservedCapacity.megaHertz", "cpu.average.totalCapacity.megaHertz", "cpu.average.demand.megaHertz", "cpu.average.usage.percent", "mem.average.reservedCapacity.megaBytes", "mem.average.totalCapacity.megaBytes", "mem.average.consumed.kiloBytes", "mem.average.swapinRate.kiloBytesPerSecond", "mem.average.swapoutRate.kiloBytesPerSecond", "datastore.average.read.kiloBytesPerSecond", "datastore.average.write.kiloBytesPerSecond", "datastore.average.numberReadAveraged.number", "datastore.average.numberWriteAveraged.number", "datastore.average.totalReadLatency.millisecond", "datastore.average.totalWriteLatency.millisecond", "mem.average.llSwapUsed.kiloBytes", "mem.average.vmmemctl.kiloBytes", "net.average.received.kiloBytesPerSecond", "net.average.transmitted.kiloBytesPerSecond", "net.summation.packetsRx.number", "net.summation.packetsTx.number", "power.average.power.watt", "hbr.average.hbrNetTx.kiloBytesPerSecond", "hbr.average.hbrNetRx.kiloBytesPerSecond", "cpu.average.usagemhz.megaHertz", "mem.average.overhead.kiloBytes", "mem.average.active.kiloBytes", "mem.average.shared.kiloBytes", "mem.average.compressed.kiloBytes", "mem.average.swapin.kiloBytes", "mem.average.swapout.kiloBytes", "cpu.average.reservedAllocation.percent", "cpu.average.unreservedAllocation.percent", "mem.average.reservedAllocation.percent", "mem.average.swapped.kiloBytes", "mem.average.usage.percent"
vm_metric_allowlist = "cpu.latest.demandEntitlementRatio.percent", "cpu.average.usagemhz.megaHertz", "cpu.average.usage.percent", "cpu.summation.ready.millisecond", "mem.average.consumed.kiloBytes", "mem.average.granted.kiloBytes", "mem.average.vmmemctltarget.kiloBytes", "mem.average.vmmemctl.kiloBytes", "mem.average.active.kiloBytes", "mem.average.usage.percent", "datastore.average.totalReadLatency.millisecond", "datastore.average.totalWriteLatency.millisecond", "datastore.average.read.kiloBytesPerSecond", "datastore.average.write.kiloBytesPerSecond", "net.average.received.kiloBytesPerSecond", "net.average.transmitted.kiloBytesPerSecond", "net.summation.packetsRx.number", "net.summation.packetsTx.number", "power.average.power.watt", "mem.average.overhead.kiloBytes", "mem.average.shared.kiloBytes", "mem.average.compressed.kiloBytes", "mem.average.swapped.kiloBytes", "datastore.average.storage_committed.bytes","datastore.average.storage_uncommitted.bytes", "datastore.average.storage_used_percent.percent", "disk.average.usage.kiloBytesPerSecond"
cluster_metric_allowlist = (?!cpu.average.reservedCapacity.megaHertz).*(clusterServices|cpu).*
# adding on demand aggregated cluster metrics as denylist which hits the maxQueryMetrics limit 
cluster_metric_denylist = (cpu.(maximum|minimum).(usagemhz.megaHertz|usage.percent)|cpu.average.corecount.contention.percent)
vc_metric_allowlist = "vcResources.average.virtualmemusage.kiloBytes", "vcResources.average.systemcpuusage.percent", "vcResources.average.physicalmemusage.kiloBytes"

Example 1:

To collect all metrics available on vCenter for host and VM entity, put blank as a value or .* regex.

[Global pool]
host_metric_allowlist = 
vm_metric_allowlist = .*

Example 2:

Use regex to restrict CPU metrics to be collected for host.

[Global pool]
// Regex should have format: group.rollup.metric.unit (cpu.average.usage.percent)
host_metric_denylist = cpu.*

Example 3:

Use regex to restrict specific metrics to be collected for vCenter. Below is an example of how to restrict the collection of vCenter's performance metrics having kiloBytes as a unit.

[Global pool]
// Regex should have format: group.rollup.metric.unit (vcResources.average.virtualmemusage.kiloBytes)
vc_metric_denylist = vcResources.*.kiloBytes