Reports reference for Content Pack for the VMware Dashboards and Reports

The Content Pack for VMware Dashboards and Reports includes several reports through which you can proactively monitor and troubleshoot your VMware environment.

Access the reports

To access the content pack reports, perform the following steps:

1. Log into Splunk Web.
2. Select App > IT Service Intelligence or IT Essentials Work.
3. From the navigation bar, select Dashboards > Reports to see the list of reports.
4. In the App column, reports listed as DA-ITSI-CP-vmware-dashboards are part of the Content Pack for VMware Dashboards and Reports.

Alert reports

The following alert related reports are available:

Report name	Description
Alarms	Shows alarms from all of the virtual centers in your environment. Click on the alarm to drill down to more details. The sourcetype vmware_inframon:events is used in the search.

CPU reports

The following CPU related reports are available:

Report name	Description
CPU Ready by VC	Displays a time chart for CPU Ready for all of the hosts.
CPU Usage by Cluster	Displays the CPU usage by cluster for all of the virtual centers in your environment.
CPU Usage by VC	Displays the CPU usage by each virtual center for the selected time.

Host system reports

The following host system related reports are available:

Report name	Description
Host System - Count by Available Memory	Displays a count of host systems by available memory. You can see the high level status and drill down for individual details for each host system. The reports is based on the source type vmware_inframon:inv:hostsystem.
Host System - Count by Cores per Socket	Displays a count of host systems by cpu cores per socket. The report is based on the source type vmware_inframon:inv:hostsystem.
Host System - Count by CPU Cores	Displays a count of the host systems by cpu cores. The reports is based on the source type vmware_inframon:inv:hostsystem.
Host System - Count by Free CPU	Displays a count of host systems with free cpu. You can see the high level status and drill down for individual details for each host system. The reports is based on the source type vmware_inframon:inv:hostsystem.
Host System - Count by Hyperthreading	Displays a count of the host systems that use hyper threading. You can see if Hyperthreading is enabled or inactive. The reports is based on the source type vmware_inframoninv:hostsystem.
Host System - Count by Logical Processors	Displays a count of host systems by logical cores that run on them. Hyperthreading is used to share the workload between them. The report is based on the source type vmware_inframon:inv:hostsystem.
Host System- Count by Manufacturer	Displays a count of the host systems by hardware vendor. The reports is based on the source type vmware_inframon:inv:hostsystem.
Host System- Count by Model	Displays a count of the host systems by hardware model. The reports is based on the source type vmware_inframon:inv:hostsystem.
Host System- Count by Number of NICs	Displays a count of the host systems by network interface controllers (NICs). The report is based on the source type vmware_inframon:inv:hostsystem.
Host System - Count by Processor Type	The report displays a count of the host systems by the type of processor they use. The report is based on the source type vmware_inframon:inv:hostsystem.
Host System - Count by ProcessorSockets	Displays a count of cpu sockets on the hosts. This number is calculated using the number of physical CPU packages (numCpuPkgs) on the host. The report is based on the source type vmware_inframon:inv:hostsystem.
Host System - Count by Status	Displays host system status as a chart and a table. You can visually see the high level status of your hosts. The report is based on the sourcetype vmware_inframon:inv:hostsystem.
Host System - Count by Total Memory	Displays a count of host systems by total memory usage for the hosts (in MB). The reports is based on the source type vmware_inframon:inv:hostsystem.
Host System - Count by Total Processing	Displays a count of the host systems by total cpu usage for the hosts. This is the total actively used cpu (in MHz). The reports is based on the source type vmware_inframon:inv:hostsystem.
Top Hosts with Ballooning	Shows the top 10 Hosts with Memory Ballooning for all the hosts. The report uses the p_average_mem_vmmemctl_kiloBytes metric. It calculates the sum of all memory balloon driver (vmmemctl) values for all powered-on virtual machines.

Memory reports

The following memory related reports are available:

Report name	Description
Memory ballooning by VC	Displays a time chart, split by hosts, showing memory ballooning for all the hosts over the selected time range. Also displays this data for each host as a table. You can see the amount of physical memory reclaimed by the host through VMware's ballooning driver. Frequent ballooning indicates a host in stress.
Memory Swapped by VC	Displays a time chart, split by hosts (vcenters), showing the amount of memory from a virtual machine that was swapped by the host. This indicates that a host is stressed and needs more memory.
Memory Usage by VC	Displays the percentage amount of memory used by the virtual machines in your environment.
Memory Utilization by Cluster	Shows memory usage for all clusters over time.

Security reports

The following security related reports are available:

Report name	Description
Vmware Security changes	Shows changes to user roles on the host systems in your environment. The source type vmware_inframon:events must be present.

Storage and network error reports

The following storage and network error related reports are available:

Report name	Description
All paths are dead	The All Paths Down (APD) state occurs when a storage device is removed from an ESX/i host in an uncontrolled manner (administrative error or device failure). This condition can affect task execution on a host as the host processes can wait for a device to return and there is no certainty that it will return. The search uses the sourcetype vmware:*log:*.
SCSI reservation error - i/o failed	Search shows virtual machines that experience I/O failures due to too many SCSI reservation conflicts. The search uses the sourcetype vmware:*log*.
Lost connectivity	VMware vSphere logs an alert that contains ' Configuration Issue' when it loses connectivity to a device. The search uses the sourcetype vmware:*log*.
Duplicate IPs	An error message indicates that a duplicate IP address exists. Search VMware ESX/i logs for the string "duplicate IP". The sourcetype vmware:esx*:* is used in the search.

Virtual machine reports

The following virtual machine related reports are available:

Report name	Description
Snapshots older than 14 days	Shows all snapshots taken that are older than 14 days. You can see the details for each snapshot including the file name, the host, when it was created, and the size of the snapshot.
Top 5 Migrated VMs	Shows the top five virtual machines that migrated across all hosts.
Top OSs	Shows the top 10 operating systems installed on the virtual machines across all of the hosts in your environment.
OS Installed on VMs	Shows the various operating systems and the associated operating system versions (if available) that are running on the virtual machines.
Virtual Machine - Count by Tools Status	Shows the status of VMware Tools running in your environment, for all of the virtual machines in your environment. The status can be "VM tools not installed", "VM tools old", and "VM tools installed", "VM tools ok", "VM tools not running", and "Not available".
Virtual Machine - Count by cores	Count by virtual machine of the number of virtual CPUs (vCPU) in a virtual machine. vCPUs in the VMware environment appears to the operating system as single core CPUs.
VMs With Old or No Tools	Search result shows all of the virtual machines in your environment that have an old version of VMware Tools installed and those that do not have VMware Tools installed.
Total VM Migrations	Displays the total number of virtual machines that migrated across all of the hosts in your environment. Drill down on the Total Migrations count to get a list of all migrated virtual machines.
Powered Off VMs	Search result produces a list of all virtual machines that were powered off. The sourcetype="vmware_inframon:inv:vm" is used in the report.