Splunk® IT Service Intelligence


This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. For documentation on the most recent version, go to the latest release.

Virtualization Module data model reference table

Use the below tables as a reference for the data models of this module. The tables contain a breakdown of the required tags for the event objects or searches in that model, and a listing of all extracted and calculated fields included in the model. Data models can be edited by navigating to Settings > Data models

For information on how to map your data to the data models available in the Splunk IT Service Intelligence Modules, see the below links:

Tags used with event objects

The following tags act as constraints to identify your events as being relevant to this data model.

Object name Tag name (Constraint) Tag name (Inherited)
Performance virtualization, performance
hostsystem virtualization, performance
|____ CPU
cpu virtualization, performance, hostsystem
|____ Memory
memory virtualization, performance, hostsystem
|____ Network
network virtualization, performance, hostsystem
|____ Storage
storage virtualization, performance, hostsystem
|_Virtual Machine
virtualmachine virtualization, performance, virtualmachine
|____ CPU
cpu virtualization, performance, virtualmachine
|____ Memory
memory virtualization, performance, virtualmachine
|____ Network
network virtualization, performance, virtualmachine
|____ Storage
storage virtualization, performance, virtualmachine
datastore virtualization, performance
|____ Storage
storage virtualization, performance, datastore
Inventory virtualization, inventory
|____ Hypervisor
hostsystem virtualization, inventory,
|____ Virtual Machine
virtualmachine virtualization, inventory
|____ Datastore
datastore virtualization, inventory

Fields for Virtualization Module event objects

The following table lists the extracted and calculated fields for the event objects in the model. Note that it does not include any inherited fields.

Object name Field name Data type Description
Performance cpu_demand Number CPU demand in MHz
Performance cpu_load_percent Number CPU load in percentage
Performance highest_latency Number Highest Disk I/O latency found in the time window of data collection in Milliseconds
Performance mem_provisioned Number Memory provisioned in bytes.
Performance mem_usage_percent Number Percentage of total memory used
Performance network_usage Number Network usage in KBps
Performance read_latency Number Disk read latency in milliseconds
Performance tag String This automatically generated field is used to access tags from within performance events.
Performance write_latency Number Disk write latency in milliseconds
Hypervisor hypervisor_id String Unique identifier (UUID) for Hypervisor
CPU cpu_allocation_percent Number Percentage of allocated CPU.
Memory mem_page_rate Number Memory read and write pages rate per second.
Virtual Machine vm_id String Unique Identifier (UUID) for Virtual Machine.
Memory mem_reserved Number Memory reserved in bytes.
Storage storage_used_percent Number Disk used in percentage.
Datastore datastore_id String Unique Identifier(UUID) for the datastore.
Storage datastore_highest_latency Number Datastore highest latency in Milliseconds.
Storage datastore_read_latency Number Datastore read latency in Milliseconds.
Storage datastore_used_percent Number Datastore storage used in percentage.
Storage datastore_write_latency Number Datastore write latency in Milliseconds.
Inventory cluster_id String Cluster Unique ID (UUID)
Inventory cluster_name String Cluster name
Inventory cpu_cores Number The number of CPU cores reported by the resource (total, not per CPU).
Inventory hypervisor_id String Unique Identifier (UUID) for hypervisor
Inventory hypervisor_name String Hypervisor name
Inventory hypervisor_os_version String OS version of the hypervisor
Inventory ip String The network addresses of the computing resource, such as or E80:0000:0000:0000:0202:B3FF:FE1E:8329.
Inventory mem_capacity Number The total amount of memory available to a resource, in megabytes.
Inventory storage_capacity Number The amount of storage capacity allocated to the resource, in megabytes.
Inventory tag String This automatically generated field is used to access tags from within data models.
Inventory vendor String The inventory vendor name
Inventory vendor_product String The inventory product version
Inventory vm_id String Unique Identifier (UUID) for virtual machine
Inventory role String Role
Hypervisor datacenter String Name of the datacenter that is assigned to Hypervisor.
Hypervisor hyperthreading String Hyperthreading status on Hypervisor.
Hypervisor hypervisor_os String Name of the Operating System of Hypervisor.
Hypervisor logical_cpu_count Number Total number of logical processors.
Hypervisor nic_count Number Total number of network interface controllers (NICs) connected on the Hypervisor.
Hypervisor nic_type String The type of network interface controller (NIC).
Hypervisor processor String Type of processor
Hypervisor processor_socket_count Number Total count of processor sockets
Hypervisor product String Product name of the Hypervisor Example: VMware ESX/ESXi or Hyper-V)
Virtual Machine datastore String Datastore name connected to hypervisor where the VM file system is stored
Virtual Machine datastore_volume_path String Path where the virtual machine file system is stored on datastore
Virtual Machine power_state String Current power status of virtual machine
Virtual Machine vm_name String Name of virtual machine
Virtual Machine vm_os String Name of the operating system of the virtual machine
Virtual Machine vm_os_version String Version number of the operating system of the virtual machine
Datastore datastore_id String Unique Identifier (UUID) for the datastore
Datastore datastore_name String Name of the datastore
Datastore datastore_version String Version number of the datastore
Datastore root_path String Identifier for the disk volume, the LUN, Disk or UNC path
Datastore root_url String Location of the datastore in the network
Datastore root_volume_type String The type of the datastore volume
Datastore serial String The serial number of the datastore appliance
Datastore storage_free_space Number Total free space of storage for the datastore in bytes
Last modified on 28 April, 2023
Virtualization Module KPIs and thresholds   Virtualization Module troubleshooting

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1, 4.18.0, 4.18.1

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters