Splunk® Content Packs for ITSI and IT Essentials Work

Splunk Content Packs for ITSI and IT Essentials Work

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Configure Data Collection for Content Pack for VMware Dashboards and Reports

Splunk Add-on for VMware Metrics collects limited performance metrics and inventory fields with the default configuration. There are additional available metrics and inventory fields that you have to enable to display data in all dashboard panels.

Configure additional performance metrics or inventory fields

To configure additional performance metrics or inventory fields, follow these steps:

  1. Stop the scheduler from the Collection Configuration page of Splunk Add-on for VMware Metrics on the data collection scheduler (DCS) machine.
  2. Stop the Splunk server on the DCS machine.
  3. On DCS machine, open or create a local copy of the inframon_ta_vmware_template.conf file in the $SPLUNK_HOME/etc/apps/local/ directory.
  4. Append the performance metrics or inventory fields that you want to configure in the [Global pool] stanza.
    1. Use the vm_metric_allowlist and vm_metric_denylist parameters in inframon_ta_vmware_template.conf file to filter the performance metrics you want to collect. To specify multiple metrics, separate the key-value pairs with a comma. Go to the Performance Metrics used to populate the dashboards for more info.
    2. Use the host_inv_fields, vm_inv_fields, and datastore_inv_fields parameters in inframon_ta_vmware_template.conf file to specify additional inventory fields you want to collect. To specify multiple inventory fields, separate the key-value pairs with a comma. Inventory Fields used to populate the dashboards for more info.
  5. Start the Splunk server on the DCS machine.
  6. Start the scheduler from the Collection Configuration page of Splunk Add-on for VMware Metrics on the DCS machine.

Example Global pool stanza:

This example [Global pool] stanza collects the performance metrics and inventory fields for populating all the dashboards and reports.

[Global pool]
host_inv_fields = "config.hyperThread", "summary.hardware.cpuMhz", "summary.hardware.cpuModel", "summary.hardware.memorySize", "summary.hardware.model", "summary.hardware.numCpuCores", "summary.hardware.numCpuPkgs", "summary.hardware.numCpuThreads", "summary.hardware.numNics", "summary.hardware.vendor", "summary.host", "summary.overallStatus", "summary.quickStats.overallCpuUsage", "summary.quickStats.overallMemoryUsage", "vm"

vm_inv_fields = "config.guestFullName", "config.hardware.memoryMB", "config.hardware.numCoresPerSocket", "config.hardware.numCPU", "guest.toolsStatus", "summary.quickStats.guestMemoryUsage", "summary.quickStats.overallCpuUsage", "summary.runtime.maxCpuUsage", "summary.runtime.maxMemoryUsage"

host_metric_allowlist = "cpu.average.reservedCapacity.megaHertz", "cpu.average.totalCapacity.megaHertz", "cpu.average.demand.megaHertz", "cpu.average.usage.percent", "mem.average.reservedCapacity.megaBytes", "mem.average.totalCapacity.megaBytes", "mem.average.consumed.kiloBytes", "mem.average.swapinRate.kiloBytesPerSecond", "mem.average.swapoutRate.kiloBytesPerSecond", "datastore.average.read.kiloBytesPerSecond", "datastore.average.write.kiloBytesPerSecond", "datastore.average.numberReadAveraged.number", "datastore.average.numberWriteAveraged.number", "datastore.average.totalReadLatency.millisecond", "datastore.average.totalWriteLatency.millisecond", "mem.average.llSwapUsed.kiloBytes", "mem.average.vmmemctl.kiloBytes", "net.average.received.kiloBytesPerSecond", "net.average.transmitted.kiloBytesPerSecond", "net.summation.packetsRx.number", "net.summation.packetsTx.number", "power.average.power.watt", "hbr.average.hbrNetTx.kiloBytesPerSecond", "hbr.average.hbrNetRx.kiloBytesPerSecond", "cpu.average.usagemhz.megaHertz", "mem.average.overhead.kiloBytes", "mem.average.active.kiloBytes", "mem.average.shared.kiloBytes", "mem.average.compressed.kiloBytes", "mem.average.swapin.kiloBytes", "mem.average.swapout.kiloBytes", "cpu.average.reservedAllocation.percent", "cpu.average.unreservedAllocation.percent", "mem.average.reservedAllocation.percent", "mem.average.swapped.kiloBytes", "mem.average.usage.percent", "cpu.average.coreUtilization.percent", "cpu.average.latency.percent", "cpu.average.utilization.percent", "cpu.summation.costop.millisecond", "cpu.summation.idle.millisecond", "cpu.summation.ready.millisecond", "cpu.summation.run.millisecond", "cpu.summation.swapwait.millisecond", "cpu.summation.used.millisecond", "cpu.summation.wait.millisecond", "mem.average.activewrite.kiloBytes", "mem.average.compressionRate.kiloBytesPerSecond", "mem.average.decompressionRate.kiloBytesPerSecond", "mem.average.granted.kiloBytes", "mem.average.heap.kiloBytes", "mem.average.heapfree.kiloBytes", "mem.average.latency.percent", "mem.average.llSwapIn.kiloBytes", "mem.average.llSwapInRate.kiloBytesPerSecond", "mem.average.llSwapOut.kiloBytes", "mem.average.llSwapOutRate.kiloBytesPerSecond", "mem.average.lowfreethreshold.kiloBytes", "mem.average.sharedcommon.kiloBytes", "mem.average.swapused.kiloBytes", "mem.average.sysUsage.kiloBytes", "mem.average.unreserved.kiloBytes", "mem.average.zero.kiloBytes", "mem.latest.state.number", "disk.average.read.kiloBytesPerSecond", "disk.average.usage.kiloBytesPerSecond", "disk.average.write.kiloBytesPerSecond", "disk.latest.maxTotalLatency.millisecond", "datastore.latest.maxTotalLatency.millisecond", "power.average.powerCap.watt", "power.summation.energy.joule", "net.average.bytesRx.kiloBytesPerSecond", "net.average.bytesTx.kiloBytesPerSecond", "net.average.usage.kiloBytesPerSecond", "net.summation.broadcastRx.number", "net.summation.broadcastTx.number", "net.summation.droppedRx.number", "net.summation.droppedTx.number", "net.summation.errorsRx.number", "net.summation.errorsTx.number", "net.summation.multicastRx.number", "net.summation.multicastTx.number", "net.summation.unknownProtos.number", "rescpu.latest.actav15.percent", "rescpu.latest.actav1.percent", "rescpu.latest.actav5.percent", "rescpu.latest.actpk15.percent", "rescpu.latest.actpk1.percent", "rescpu.latest.actpk5.percent", "rescpu.latest.maxLimited15.percent", "rescpu.latest.maxLimited1.percent", "rescpu.latest.maxLimited5.percent", "rescpu.latest.runav15.percent", "rescpu.latest.runav1.percent", "rescpu.latest.runav5.percent", "rescpu.latest.runpk15.percent", "rescpu.latest.runpk1.percent", "rescpu.latest.runpk5.percent", "rescpu.latest.sampleCount.number", "rescpu.latest.samplePeriod.millisecond", "hbr.average.hbrNumVms.number", "storageadpater.latest.maxTotalLatency.millisecond", "storagepath.latest.maxTotalLatency.millisecond", "sys.latest.uptime.second"

vm_metric_allowlist = "cpu.latest.demandEntitlementRatio.percent", "cpu.average.usagemhz.megaHertz", "cpu.average.usage.percent", "cpu.summation.ready.millisecond", "mem.average.consumed.kiloBytes", "mem.average.granted.kiloBytes", "mem.average.vmmemctltarget.kiloBytes", "mem.average.vmmemctl.kiloBytes", "mem.average.active.kiloBytes", "mem.average.usage.percent", "datastore.average.totalReadLatency.millisecond", "datastore.average.totalWriteLatency.millisecond", "datastore.average.read.kiloBytesPerSecond", "datastore.average.write.kiloBytesPerSecond", "net.average.received.kiloBytesPerSecond", "net.average.transmitted.kiloBytesPerSecond", "net.summation.packetsRx.number", "net.summation.packetsTx.number", "power.average.power.watt", "mem.average.overhead.kiloBytes", "mem.average.shared.kiloBytes", "mem.average.compressed.kiloBytes", "mem.average.swapped.kiloBytes", "datastore.average.storage_committed.bytes", "datastore.average.storage_uncommitted.bytes", "datastore.average.storage_used_percent.percent", "disk.average.usage.kiloBytesPerSecond", "cpu.average.coreUtilization.percent", "cpu.average.demand.megaHertz", "cpu.average.latency.percent", "cpu.average.reservedCapacity.megaHertz", "cpu.average.totalCapacity.megaHertz", "cpu.average.utilization.percent", "cpu.latest.entitlement.megaHertz", "cpu.summation.costop.millisecond", "cpu.summation.idle.millisecond", "cpu.summation.maxlimited.millisecond", "cpu.summation.overlap.millisecond", "cpu.summation.run.millisecond", "cpu.summation.system.millisecond", "cpu.summation.swapwait.millisecond", "cpu.summation.used.millisecond", "cpu.summation.wait.millisecond", "mem.average.activewrite.kiloBytes", "mem.average.compressionRate.kiloBytesPerSecond", "mem.average.decompressionRate.kiloBytesPerSecond", "mem.average.entitlement.kiloBytes", "mem.average.heap.kiloBytes", "mem.average.heapfree.kiloBytes", "mem.average.latency.percent", "mem.average.llSwapIn.kiloBytes", "mem.average.llSwapInRate.kiloBytesPerSecond", "mem.average.llSwapOut.kiloBytes", "mem.average.llSwapOutRate.kiloBytesPerSecond", "mem.average.llSwapUsed.kiloBytes", "mem.average.lowfreethreshold.kiloBytes", "mem.average.overheadMax.kiloBytes", "mem.average.overheadTouched.kiloBytes", "mem.average.reservedCapacity.megaBytes", "mem.average.sharedcommon.kiloBytes", "mem.average.swapin.kiloBytes", "mem.average.swapinRate.kiloBytesPerSecond", "mem.average.swapout.kiloBytes", "mem.average.swapoutRate.kiloBytesPerSecond", "mem.average.swaptarget.kiloBytes", "mem.average.swapused.kiloBytes", "mem.average.sysUsage.kiloBytes", "mem.average.totalCapacity.megaBytes", "mem.average.unreserved.kiloBytes", "mem.average.zero.kiloBytes", "mem.latest.state.number", "mem.latest.zipped.kiloBytes", "mem.latest.zipSaved.kiloBytes", "disk.average.read.kiloBytesPerSecond", "disk.average.write.kiloBytesPerSecond", "disk.latest.maxTotalLatency.millisecond", "datastore.latest.maxTotalLatency.millisecond", "power.average.powerCap.watt", "power.summation.energy.joule", "net.average.bytesRx.kiloBytesPerSecond", "net.average.bytesTx.kiloBytesPerSecond", "net.average.usage.kiloBytesPerSecond", "net.summation.broadcastRx.number", "net.summation.broadcastTx.number", "net.summation.droppedRx.number", "net.summation.droppedTx.number", "net.summation.errorsRx.number", "net.summation.errorsTx.number", "net.summation.multicastRx.number", "net.summation.multicastTx.number", "net.summation.unknownProtos.number", "rescpu.latest.actav15.percent", "rescpu.latest.actav1.percent", "rescpu.latest.actav5.percent", "rescpu.latest.actpk15.percent", "rescpu.latest.actpk1.percent", "rescpu.latest.actpk5.percent", "rescpu.latest.maxLimited15.percent", "rescpu.latest.maxLimited1.percent", "rescpu.latest.maxLimited5.percent", "rescpu.latest.runav15.percent", "rescpu.latest.runav1.percent", "rescpu.latest.runav5.percent", "rescpu.latest.runpk15.percent", "rescpu.latest.runpk1.percent", "rescpu.latest.runpk5.percent", "rescpu.latest.sampleCount.number", "rescpu.latest.samplePeriod.millisecond", "sys.latest.osUptime.second", "sys.latest.uptime.second", "sys.summation.heartbeat.number"

Performance Metrics used to populate the dashboards

These are the performance metrics collected by Splunk Add-on for VMware Metrics that are used in the dashboards in this content pack. Metrics without an asterisk are collected by default. Metrics with an asterisk have to be configured to collect the data. Go to Configure additional performance metrics or inventory fields for steps to configure additional metrics.

The indexed field is the metric name of the performance metric in the indexed performance data.

For a complete list of performance metrics available via the Splunk Add-on for VMWare Metrics go to the Performance metrics reference for the Splunk Add-on for VMware Metrics.

Dashboard Type Parameter value in the .conf file Indexed field
Home Performance Virtual Machine:

cpu.average.usage.percent
mem.average.usage.percent
cpu.summation.ready.millisecond

Host Systems:
mem.average.vmmemctl.kiloBytes
mem.average.llSwapUsed.kiloBytes
cpu.average.usage.percent

Virtual Machine:

vsphere.vm.cpu.usage
vsphere.vm.mem.usage
vsphere.vm.cpu.ready

Host Systems:
vsphere.esxihost.mem.vmmemctl
vsphere.esxihost.mem.llSwapUsed
vsphere.esxihost.cpu.usage

Cluster Detail Performance Virtual Machine:

mem.average.vmmemctl.kiloBytes
mem.average.swapped.kiloBytes
mem.average.overhead.kiloBytes
mem.average.consumed.kiloBytes
mem.average.usage.percent
cpu.average.usage.percent
cpu.average.usagemhz.megaHertz

Virtual Machine:

vsphere.vm.mem.vmmemctl
vsphere.vm.mem.swapped
vsphere.vm.mem.usage
vsphere.vm.mem.overhead
vsphere.vm.mem.consumed
vsphere.vm.cpu.usage
vsphere.vm.cpu.usagemhz

Host System Detail Performance Host Systems:

cpu.average.usage.percent
mem.average.vmmemctl.kiloBytes
mem.average.usage.percent
mem.average.llSwapIn.kiloBytes*
mem.average.llSwapOut.kiloBytes*


*Additional metrics have to be enabled to populate the line chart. Go to the additional metrics for the Host Systems entity for more info.

Host Systems:

vsphere.esxihost.cpu.usage
vsphere.esxihost.mem.vmmemctl
vsphere.esxihost.mem.usage
vsphere.esxihost.mem.llSwapIn*
vsphere.esxihost.mem.llSwapOut*

Virtual Machine Detail Performance *Additional metrics have to be enabled to populate the line chart. Go to the additional metrics for the Virtual Machines entity for more info.
Performance of Hosts and VMs Performance *Additional metrics have to be enabled to populate the line chart. Go to the additional metrics for the Host Systems entity and additional metrics for the Virtual Machines entity for more info.
Proactive Monitoring Performance *Additional metrics have to be enabled to populate the tree. Go to the additional metrics for the Host Systems entity and additional metrics for the Virtual Machines entity for more info.
Capacity Forecasting Performance Virtual Machine:

disk.average.usage.kiloBytesPerSecond

Host Systems:
cpu.average.usage.percent
mem.average.usage.percent

Virtual Machine:

vsphere.vm.disk.usage

Host Systems:
vsphere.esxihost.cpu.usage
vsphere.esxihost.mem.usage

Capacity Planning for Clusters - CPU Headroom Performance Virtual Machine:

cpu.average.usagemhz.megaHertz

Virtual Machine:

vsphere.vm.cpu.usagemhz

Capacity Planning for Clusters - Memory Headroom Performance Virtual Machine:

mem.average.consumed.kiloBytes
mem.average.overhead.kiloBytes

Virtual Machine:

vsphere.vm.mem.consumed
vsphere.vm.mem.overhead

Capacity Planning (Clusters) Performance Virtual Machine:

cpu.average.usagemhz.megaHertz
mem.average.consumed.kiloBytes
mem.average.overhead.kiloBytes

Virtual Machine:

vsphere.vm.cpu.usagemhz
vsphere.vm.mem.consumed
vsphere.vm.mem.overhead

Capacity Planning (Hosts) Performance Host Systems:

cpu.average.usage.percent
mem.average.usage.percent

Host Systems:

vsphere.esxihost.cpu.usage
vsphere.esxihost.mem.usage

Inventory Fields used to populate the dashboards

These are the inventory fields collected by Splunk Add-on for VMware Metrics that are used in the dashboards in this content pack. Fields without an asterisk are collected by default. Fields with an asterisk have to be configured to collect the data. Go to Configure additional performance metrics or inventory fields for steps to configure additional fields.

For a complete list of inventory fields available via the Splunk Add-on for VMWare Metrics go to the Inventory fields reference for the Splunk Add-on for VMware Metrics.

Dashboard Type Parameter value in .conf file
Home Inventory Datastore:

summary

Hierarchy:
runtime.host
parent

Cluster Detail Inventory Host Systems:

name
parent
datastore
summary.overallStatus*
summary.overallStatus*
summary.quickStats.overallCpuUsage*
summary.quickStats.overallMemoryUsage*
summary.hardware.cpuMhz*
summary.hardware.memorySize*
summary.hardware.numCpuCores*
summary.hardware.vendor*
summary.hardware.model*
summary.hardware.numNics*
summary.hardware.cpuModel*
summary.hardware.numCpuPkgs*
summary.hardware.numCpuThreads*
summary.host*
config.hyperThread*
vm*

Datastore:
summary
info

Hierarchy:
runtime.host
name
parent

*Additional inventory fields have to be enabled.

Host System Detail Inventory Virtual Machine:

summary.runtime.powerState
summary.runtime.host

Host Systems:
name
parent
summary.overallStatus*
summary.quickStats.overallCpuUsage*
summary.quickStats.overallMemoryUsage*
summary.hardware.cpuMhz*
summary.hardware.memorySize*
summary.hardware.numCpuCores*
summary.hardware.vendor*
summary.hardware.model*
summary.hardware.numNics*
summary.hardware.cpuModel*
summary.hardware.numCpuPkgs*
summary.hardware.numCpuThreads*
summary.host*
config.hyperThread*
vm*

Datastore:
summary
info

Hierarchy:
runtime.host
name
parent

*Additional inventory fields have to be enabled.

Virtual Machine Detail Inventory Virtual Machine:

datastore
layoutEx.file
name
summary.runtime.powerState
summary.runtime.host
resourceConfig
storage.perDatastoreUsage
config.guestFullName*
guest.toolsStatus*
config.hardware.numCPU*
config.hardware.numCoresPerSocket*
config.hardware.memoryMB*
summary.runtime.maxCpuUsage *
summary.runtime.maxMemoryUsage*
summary.quickStats.overallCpuUsage*
summary.quickStats.guestMemoryUsage*

Datastore:
summary
info

Hierarchy:
runtime.host
name
parent

*Additional inventory fields have to be enabled.

Datastore Detail Inventory

Virtual Machine:
name
layoutEx.file
storage.perDatastoreUsage
summary.runtime.host

Datastore:
info
summary
vm

Proactive Monitoring Inventory Virtual Machine:

name
summary.runtime.powerState
summary.runtime.host
resourceConfig
config.guestFullName*
guest.toolsStatus*
config.hardware.numCPU*
config.hardware.numCoresPerSocket*
config.hardware.memoryMB*

Host Systems:
name
parent
summary.overallStatus*
summary.quickStats.overallCpuUsage*
summary.quickStats.overallMemoryUsage*
summary.hardware.cpuMhz*
summary.hardware.memorySize*
summary.hardware.numCpuCores*
summary.hardware.vendor*
summary.hardware.model*
summary.hardware.numNics*
summary.hardware.cpuModel*
summary.hardware.numCpuPkgs*
summary.hardware.numCpuThreads*
summary.host*
config.hyperThread*

Hierarchy:
runtime.host
name
parent

*Additional inventory fields have to be enabled.

Last modified on 06 August, 2021
PREVIOUS
Install and Configure the Content Pack for VMware Dashboards and Reports
  NEXT
Migrate from the Splunk Supporting Add-on for VMware or the Splunk App for VMware to the Content Pack for VMware Dashboards and Reports

This documentation applies to the following versions of Splunk® Content Packs for ITSI and IT Essentials Work: current


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters