Splunk® App for VMware (Legacy)

Configuration Guide

Acrobat logo Download manual as PDF


On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of Splunk® App for VMware (Legacy). For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Data collection configuration file reference

Edit ta_vmware_collection.conf on the search head only to enable or disable instance level data and to whitelist or blacklist metric collection. You can find the specification for ta_vmware_collection.conf in Splunk_TA_vmware/bin/ta_vmware/models.py.


# Copyright (C) 2005-2015 Splunk Inc. All Rights Reserved. 

[default]
#These are all the tasks that should run everywhere
task = hostvmperf, otherperf, hierarchyinv, hostinv, vminv, clusterinv, datastoreinv, rpinv, task, event
#These are the destination indexes for the different data types
perf_index = vmware-perf
inv_index = vmware-inv
taskevent_index = vmware-taskevent
# Object count value in API response for inventory collector
# This values has to be greater than equal to 1. If you set this value with higher value then hostinv will take more memory
# to process the api response. If you set this value too low then it increases the load on VC as API calls increase.
#inv_maxObjUpdates = 20
#The following are the collection intervals for particular tasks
hostvmperf_interval = 180
# Setting interval to < 30 min results in missing cluster data
otherperf_interval = 2000 
hierarchyinv_interval = 300
hostinv_interval = 900
vminv_interval = 900
clusterinv_interval = 1800
datastoreinv_interval = 900
rpinv_interval = 900
task_interval = 300
event_interval = 300
#The following are the expiration periods for particular tasks
hostvmperf_expiration = 180
otherperf_expiration = 1900
task_expiration = 3600
event_expiration = 3600
hierarchyinv_expiration = 300
hostinv_expiration = 900
vminv_expiration = 900
clusterinv_expiration = 1800
datastoreinv_expiration = 900
rpinv_expiration = 900
#Performance format type. This is used to define format which is used to retrieve perf data form vmware. Make sure it has value either csv or normal
perf_format_type = csv
# For HostSystem Inv, only config.hyperThread is collected by default
# Add other properties as follows, example:
# hostsystem_inv_config = config.adminDisabled, config.host 
# Default whitelists / blacklists for entities:
# resource pools should be turned off
perf_entity_blacklist = ^ResourcePool$
# Default whitelists / blacklists for metrics:
# for clusters, only clusterServices counter group should be collected
cluster_metric_whitelist = ^p_[^_]*_clusterServices.*
# datagen flags for internal use only
autoeventgen = false
autoeventgen_poweroff_vmcount = 0

# The following lines should NOT be commented if you want to collect instance level data
# host_instance_whitelist = .*
# vm_instance_whitelist = .*
# rp_instance_whitelist = .*
# cluster_instance_whitelist = .*

Last modified on 22 June, 2016
PREVIOUS
Storage requirements for tsidx namespaces
  NEXT
Data model acceleration configuration file reference

This documentation applies to the following versions of Splunk® App for VMware (Legacy): 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.2.0, 3.2.1, 3.2.2


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters