Splunk® IT Service Intelligence

Modules

Download manual as PDF

This documentation does not apply to the most recent version of ITSI. Click here for the latest version.
Download topic as PDF

Virtualization Module KPIs and thresholds

The default KPI calculation window for this module is Last 15 minutes, and calculation interval is Every 5 minutes. Adjust the search calculation interval for each supported add-on to match the five minute ITSI module calculation interval.

Adjust the search calculation time for this module:

  1. Within ITSI, navigate to Configure, and select KPI Base Searches.
  2. Navigate to the KPI you wish to modify, and select Edit, followed by Clone.
  3. Name your cloned KPI base search and click Clone Page.
  4. Click on the KPI you wish to modify.
  5. Navigate to KPI Search Schedule, and select Every 5 Minutes from the dropdown menu.
  6. Click Save.

Virtualization Module KPI availability

KPI Name Splunk Add-on for Vmware Splunk Add-on for Microsoft Hyper-V
Hypervisor CPU Allocation X X
Hypervisor CPU Demand X
Hypervisor CPU Utilization X X
Hypervisor Memory Pages X X
Hypervisor Memory Provisioning X X
Hypervisor Memory Used X X
Hypervisor Network Utilization X X
Hypervisor Storage Highest Latency X X
Hypervisor Storage Read Latency X X
Hypervisor Storage Write Latency X X
Virtual Machine CPU Demand X
Virtual Machine CPU Utilization X X
Virtual Machine Memory Provisioning X X
Virtual Machine Memory Reserved X X
Virtual Machine Memory Used X
Virtual Machine Network Utilization X
Virtual Machine Storage Highest Latency X X
Virtual Machine Storage Read Latency X X
Virtual Machine Storage Used X X
Virtual Machine Storage Write Latency X X
Datastore Highest Latency X X
Datastore Read Latency X X
Datastore Storage Used X X
Datastore Write Latency X X


KPI and Threshold Reference Table

Hypervisor Monitoring

KPI Name Description Unit Type Threshold Values
Hypervisor CPU Allocation The percentage of CPU resources allocated to all the VMs for the host. % Static: Normal < 30 < Low < 50 < Medium < 75 < High < 90 < Critical
Hypervisor CPU Demand The amount of CPU resources a host would use if there were no CPU contention or CPU limit. MHz Adaptive - 7 days
Hypervisor CPU Utilization Actively used CPU of the host, as a percentage of the total available CPU. Active CPU is approximately equal to the ratio of the used CPU to the available CPU. % Static: Normal < 30 < Low < 50 < Medium < 75 < High < 90 < Critical
Hypervisor Memory Pages Pages/sec is the rate at which pages are read from or written to disk, to resolve hard page faults. This is a measure of memory pressure because it tracks hard faults. Hard faults are page faults that require disk access. Count Adaptive - 7 days
Hypervisor Memory Provisioning The sum of all vmmemctl(memory ballooning) values for all powered-on virtual machines, plus management server (e.g. vSphere) on the host. If the balloon target value is greater than the balloon value, the VMkernel inflates the balloon, causing more virtual machine memory to be reclaimed. If the balloon target value is less than the balloon value, the VMkernel deflates the balloon, which allows the virtual machine to consume additional memory if needed. % Adaptive - 7 days
Hypervisor Memory Used Average memory usage as a percent of total memory. % Static: Normal < 30 < Low < 50 < Medium < 75 < High < 90 < Critical
Hypervisor Network Utilization Network utilization (combined transmit- and receive-rates) across the host's physical adapter. Sum of data transmitted and received across all physical NIC instances connected to the host. KBps Adaptive - 7 days
Hypervisor Storage Highest Latency Highest latency value across all disks used by the host. Latency measures the time taken to process an SCSI command issued by the guest OS to the virtual machine. The kernel latency is the time the VMkernel takes to process an IO request. The device latency is the time it takes the hardware to handle the request. ms Info: Low < 10 < Medium < 15 < High
Hypervisor Storage Read Latency Average amount of time taken during the collection interval to process an SCSI read command issued from the Guest OS to the virtual machine. The sum of kernelReadLatency and deviceReadLatency. ms Static: Low < 10 < Medium < 15 < High
Hypervisor Storage Write Latency Average amount of time taken during the collection interval to process an SCSI write command issued by the Guest OS to the virtual machine. The sum of kernelWriteLatency and deviceWriteLatency. ms Static: Low < 10 < Medium < 15 < High

Virtual Machine Monitoring

KPI Name Description Unit Type Threshold Values
Virtual Machine CPU Demand The amount of CPU resources a virtual machine would use if there were no CPU contention or CPU limit. MHz Adaptive - 7 days
Virtual Machine CPU Utilization Average CPU Usage in percent. % Normal < 30 < Low < 50 < Medium < 75 < High < 90 < Critical
Virtual Machine Memory Provisioning Amount of guest physical memory that is currently reclaimed from the virtual machine through ballooning. This is the amount of guest physical memory that has been allocated and pinned by the balloon driver. MB Adaptive - 7 days
Virtual Machine Memory Reserved Amount of memory reserved by userworlds. ESX/ESXi provides a memory compression cache to improve virtual machine performance when you use memory overcommitment. Memory compression is enabled by default. When a host's memory becomes overcommitted, ESX/ESXi compresses virtual pages and stores them in memory. MB Adaptive - 7 days
Virtual Machine Memory Used Average memory usage as a percent of total memory. % Normal < 30 < Low < 50 < Medium < 75 < High < 90 < Critical
Virtual Machine Network Utilization Network utilization (combined transmit- and receive-rates) across the VM's virtual network adapter. Sum of data transmitted and received across all NIC instances connected to the VM. KBps Adaptive - 7 days
Virtual Machine Storage Highest Latency Highest latency value across all disks used by the host. Latency measures the time taken to process an SCSI command issued by the guest OS to the virtual machine. The kernel latency is the time VMkernel takes to process an IO request. The device latency is the time it takes the hardware to handle the request. ms Info: Low < 10 < Medium < 15 < High
Virtual Machine Storage Read Latency Average amount of time taken during the collection interval to process an SCSI read command issued from the Guest OS to the virtual machine. The sum of kernelReadLatency and deviceReadLatency. ms Low < 10 < Medium < 15 < High
Virtual Machine Storage Used Amount of space actually used by the virtual machine. May be less than the amount provisioned at any given time, depending on whether the virtual machine is powered-off, whether snapshots have been created or not, and other such factors. % Low < 30 < Normal < 50 < Medium < 75 < High < 90 < Critical
Virtual Machine Storage Write Latency Average amount of time taken during the collection interval to process an SCSI write command issued by the Guest OS to the virtual machine. The sum of kernelWriteLatency and deviceWriteLatency. ms Low < 10 < Medium < 15 < High

Datastore Monitoring

KPI Name Description Unit Type Threshold Values
Datastore Highest Latency Highest latency value across all disks used by the host. Latency measures the time taken to process an SCSI command issued by the guest OS to datastore. ms Info: Low < 10 < Medium < 15 < High
Datastore Read Latency Average amount of time for a read operation from the datastore. Total latency = kernel latency + device latency. ms Static: Low < 10 < Medium < 15 < High
Datastore Storage Used Amount of space actually used by the datastore. % Normal < 30 < Low < 50 < Medium < 75 < High < 90 < Critical
Datastore Write Latency Average amount of time for a write operation from the datastore. Total latency = kernel latency + device latency. ms Static: Low < 10 < Medium < 15 < High
Last modified on 18 March, 2020
PREVIOUS
Virtualization Module configurations
  NEXT
Virtualization Module data model reference table

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.1.1, 4.1.2, 4.1.5, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters